Customizing Security Settings
Any device connected to an external network, like the Internet, is vulnerable to attacks. Because users carry their Pocket PC or Smartphone with them, the devices are prone to network attacks in addition to physical intrusion. Mobile Operators can use security policies to make it harder for intruders to break in.
To be able to make an informed decision about the level of security to provide, you must understand the capabilities and consider a balance between security and usability. A wrong configuration can make the device unfriendly even to the owner.
The Mobile Operator typically determines the requirements for the security policy. There is a trade-off between application compatibility and device security. Although there are many policies, the following four policy options show the balance of compatibility and security.
- Security OFF — no security checks are performed.
- Prompt — The user is prompted when the source is unknown or is anonymous.
- 3rdPartySigned — Third-party vendors that are identified through the Mobile-2-Market program are allowed access.
- Locked — Only the OEM and Mobile Operator, or their licensed vendors, are allowed access.
For a more complete description of these policy options, including the resulting behavior for application execution, device configuration, and remote access, see Selecting Security Configuration.
You use security policies to enforce security settings, with the help of security roles and certificates. The following table describes how these elements work together.
| Security element | Description |
|---|---|
| Security Policies | Security Policy settings define levels of security. For example, policies indicate whether including whether devices are configurable over-the-air (OTA), whether mobile operators can be assigned the Trusted Provisioning Server (TPS) role, and whether to accept unsigned messages, applications, or files.
Security policy settings provide the flexibility to control how secure the software is. Security policy settings are defined globally and enforced locally in their respective components at critical points across the Smartphone architecture. Often these policy settings will interact with Configuration Manager and software security settings. When the device is initialized during the cold boot process, a set of default policy settings are configured in the software. The mobile operator can later change the security settings by provisioning the device. Security Policies are indexed by the decimal representation of the policy ID. By default, security policies can only be changed by the manager of the device. For a detailed description of each security policy, see Security Policy Settings. |
| Security Roles | Security policies use roles to determine whether or not a message is accepted, and if it is accepted, what level of access it is allowed. For example, a security role would indicate whether setting can be changed by a Trusted Provisioning Server (TPS).
By changing the role, you can allow or restrict access to device resources. For a detailed description of security roles, see Security Roles. |
| Digital certificates | Digital certificates are used to assign a role to an application or a file seeking access to the software.
After the certificate is created or acquired, it must be placed in one of the stores in the device. You can do this by using the CertificateStore Configuration Service Provider. If no matching certificate is found in the appropriate certificate store, it is perceived as unsigned. The default role is assigned based on the security policy if an application is not signed. For more information, see Certificate Management in Windows Mobile-based Devices. |
Before you change policies, you need to determine what the current policies are on the device. You use the SecurityPolicy Configuration Service Provide to both query and configure security policy settings. For instructions that walk you through this process as well as packaging the XML and sending it to the device, see How To Change Security Policies.
- How To Change Security Policies
Walks your through the process of changing Security Policies, including choosing a method of delivery, querying device policies before you change them, determining the settings that you want to make, creating an XML file, packaging the file if needed, and delivering the file to the device. - Security Policy Settings
Provides and list and detailed description of Security Policies. - Security and Device Management
Provides general security best practices for Managing Devices - SecurityPolicy Configuration Service Provider
Describes the Configuration Service Provider that allows you to configure the security policy settings of the device. - Provisioning Security Settings
Provides information about provisioning security settings and links to security related Configuration Service Providers.
Send Feedback on this topic to the authors