Screen Lock and Authentication
Screen lock methods in order of strength: Swipe (no security — just prevents accidental activation). PIN: 4–6+ digit number. Password: alphanumeric, most secure lock method. Pattern: visual swipe pattern — moderate security, fingerprints on screen can reveal pattern. Fingerprint scanner: biometric, convenient, quick. Face recognition: biometric, varies widely in security (2D face recognition can be fooled by photos; 3D face recognition with infrared is much more secure). Enterprise policy: MDM can enforce minimum PIN/password requirements and lock-out after failed attempts.
Full-device encryption: encrypts all data on the device storage — if someone bypasses the lock screen or removes the storage chip, data is unreadable without the key. Modern iOS and Android devices are encrypted by default. Tied to the lock screen PIN/password — strong screen lock means strong encryption. Resetting to factory state destroys the encryption key, rendering stored data unrecoverable.
Failed attempt lockout: after a configurable number of failed PIN/password attempts, the device locks for increasing time periods, or in enterprise MDM, wipes itself automatically. iOS default: after 10 failed attempts with 'Erase Data' enabled, device wipes. MDM can enforce: wipe after 5 failed attempts.
Remote Management and Enterprise Security
Remote wipe: erases all data on a lost or stolen device remotely. iOS: via iCloud 'Find My' — sends erase command when device connects to internet. Android: via Google 'Find My Device' — same concept. Enterprise MDM: can wipe immediately or selectively (remove only corporate data, leaving personal data on personal devices — BYOD scenarios). Always test remote wipe functionality before it is needed — verify enrollment and connectivity.
MDM (Mobile Device Management): enterprise platform that manages mobile devices at scale. Capabilities: enforce screen lock and complexity policies, push Wi-Fi and VPN configurations, remotely lock or wipe, push and remove apps, prevent camera use, require encryption, geo-fence (alert if device leaves a defined area). Enrollment: corporate-owned devices (COPE — Corporate Owned, Personally Enabled) vs BYOD (Bring Your Own Device — personal device enrolled in MDM with management profile).
Locator services: Find My (Apple) and Find My Device (Google) use GPS, Wi-Fi positioning, and cellular location to track lost devices. Also enables 'lost mode' — displays a message with contact information on the lock screen. Enable before the device is lost. Location services must be enabled for tracking to work.
Authenticator apps and MFA: beyond the screen lock, apps increasingly require MFA. Authenticator apps (Google Authenticator, Microsoft Authenticator, Authy) generate time-based one-time passwords (TOTP). Push-notification MFA (Duo, Microsoft Authenticator) — approve a push notification on a trusted device. SMS-based MFA: least secure (SIM swapping attacks), but better than no MFA.