Securing Your Phone and Apps

10 min readBeginner

Where you are: Unit V — Machines and Networks Under Attack · Lesson 5.6 (Section 5B — Protecting Your Devices) · This topic is new in the 2026 edition of the course. It extends Dr. Al-Doori's Unit V to the device most people use most: the phone.

Dr. Al-Doori's chapters on malware and defense were written with the computer in mind. Everything they teach about layers still applies, but for most people today the device that holds their email, banking, photos, messages and sign-in codes is the phone in their pocket. This lesson applies the layered approach from Lesson 5.4 to that phone.

What you'll be able to do

Configure your phone's updates, screen lock, app permissions and recovery so it is not your weakest link. By the end of this lesson you will be able to:

check the seven phone settings that matter most for security;
decide which app permissions to allow, limit or remove;
protect the accounts that control your phone and your phone number, including your mobile carrier account.

Why Your Phone Deserves Its Own Lesson

Phones are now the main way people go online. StatCounter's figures for September 2026 show Android as the most used operating system worldwide across all devices, at about 43% of usage, with Apple's iOS at about 19%. Phones are also where many scams arrive: Verizon's 2026 Data Breach Investigations Report found that social-engineering lures designed for mobile devices, such as texts and voice calls, got about 40% higher click rates than email in the tests it studied.

A phone is also a key. It often receives your sign-in codes, holds your passkeys and password manager, and is linked to your email account. Anyone who controls your phone, or just your phone number, may be able to unlock much of your digital life.

Seven Settings That Matter

1. Automatic updates. Phone updates fix security weaknesses just as computer updates do. Turn on automatic updates for the system and for apps, install waiting updates, and restart when asked. If your phone no longer receives security updates from its maker, plan to replace it, as you learned for computers in Lesson 5.4.

2. A strong screen lock. Your lock screen is the front door. The US Federal Trade Commission (FTC) advises a passcode of at least six digits rather than four, and a longer password is stronger still. Face or fingerprint unlock is a convenient way to avoid typing it every time; the passcode still matters because it is the fallback. Set the screen to lock automatically after a short time.

3. Trusted app sources. Install apps from your phone's official app store, and check the developer name before installing. Be wary of messages or websites that urge you to install an app from a link. On Android, keep Google Play Protect switched on: it is the built-in protection that checks apps for harmful behavior.

4. App permissions. A permission is something an app asks to access, such as your location, camera, microphone, contacts or photos. Google's Android Help explains how to review and change these at any time, and both major phone systems offer similar controls. Ask one question for each permission: does this app need this to do its job? A map app needs your location; a torch app does not. Where the choice exists, allow location only while the app is in use. Remove apps you no longer use, since each one is something that can be misused.

5. Account recovery. Your phone is tied to a main account (for example your Apple Account or Google Account) that can back up, locate and even erase the phone. Protect that account as you did your most important accounts in Unit IV: a strong unique password or a passkey, multi-factor authentication, and up-to-date recovery details (Lesson 4.7).

6. Lost-device controls. The major phone systems let you find a lost phone from another device by signing in to that main account; Google's Android Help, for example, explains how to find, secure or erase a lost Android device remotely. Check that this feature is switched on before you need it. Remember the lesson of Mat Honan (Lesson 1.3): attackers who took over his Apple ID used this kind of feature to wipe his devices. Strong protection for the main account keeps a helpful tool from becoming a weapon.

7. SIM and carrier-account protection. Your SIM links your phone number to your phone. In a SIM swap, a criminal persuades or tricks your mobile carrier into moving your number to a SIM they control. From that moment, your calls and text messages, including sign-in codes sent by text, go to them. CISA's mobile guidance, written mainly for people at high risk but applicable to everyone, advises you to set a PIN or password on your mobile carrier account and to protect that account with multi-factor authentication. It also notes that text messages are not encrypted, which is one reason Lesson 4.5 ranked text-message codes as the weakest form of multi-factor authentication.

Try It: A Phone Settings Check

Privacy note: do this check privately on your own device. Never write down, share, upload or submit real passwords, recovery codes, MFA secrets or QR codes, account names, email addresses, phone numbers, home IP addresses, router credentials, screenshots of your accounts, or private messages. If anything is asked for, it is only a completion confirmation, redacted observations, a risk level and your action plan.

Take about ten minutes with your own phone. Note privately only whether each item is done.

Updates: automatic system and app updates are on, and nothing is waiting to install.
Screen lock: a passcode of at least six digits (or a password) is set, and the screen locks automatically after a short time.
App sources: every app came from the official store; on Android, Play Protect is on.
Permissions: open the permissions or privacy section and review location, camera, microphone and contacts. Remove any access an app does not need.
Unused apps: delete apps you have not used in months.
Main account: it has multi-factor authentication (or a passkey) and current recovery details.
Lost-device controls: the locate, lock and erase feature is switched on.
Carrier account: contact your carrier, through its official app, website or a number you look up yourself, to ask about adding an account PIN, if you don't have one.
Backup: your phone's backup is switched on (Lesson 5.5).

Finish by writing your top two actions in your private plan. That is all you would ever need to report.

Real-World Example

In February 2022 the FBI's Internet Crime Complaint Center issued a public warning about SIM-swap fraud. It reported 1,611 SIM-swap complaints in 2021, with losses of more than $68 million, compared with about $12 million in total over 2018 to 2020. The pattern it described is simple: criminals take over a victim's phone number, then use the text-message codes that arrive to get into email, banking and cryptocurrency accounts.

Notice that no malware was needed. The weak point was the carrier account and the use of text messages as the only second step, which is exactly what settings 5 and 7 above address.

Why This Matters in 2026

The original book focused on computers, because that is where most people did their important digital tasks when it was written. Modern platforms have changed this risk picture: today the phone is the main device for most people, the main channel for scams, and often the key to every other account. Phones also come with strong built-in protections, such as automatic updates, app-store checks, permission controls and lost-device tools, but many of them only help if you switch them on and keep the accounts behind them secure. Current guidance from CISA and the FBI adds a newer concern that the classic computer-focused advice could not cover: protecting your phone number through your carrier account, and moving important accounts away from text-message codes toward app-based codes or passkeys.

What Would You Do?

You are at home when your phone suddenly shows "No service", even though it worked a few minutes ago and others in your home have signal. Shortly afterwards, on your laptop, you see emails saying password-reset codes were requested for your email account. What is probably happening, and what do you do?

Knowledge Check

A free photo-filter app asks for access to your contacts, microphone and precise location. What is the best choice?

Which step most directly protects you against a SIM swap?

Answers explained

What Would You Do? Sudden loss of service while others have signal, followed by password-reset codes, matches the pattern of a SIM swap: someone may have moved your number. Act quickly. From another device or phone, contact your carrier through a number you look up yourself and report it. Use your laptop to secure your email first: change the password, sign out other sessions and check recovery details (Lesson 6.1). Alert your bank. Afterwards, add a carrier account PIN and switch important accounts from text-message codes to an authenticator app or passkeys.

Question 1 — c. Ask whether each permission is needed for the app's job: a photo filter needs your photos, not your contacts, microphone or precise location. Allowing everything (a) hands over data the app does not need. Deleting later (b) does not undo access already given. Denying everything (d) goes too far, because some permissions are needed for apps to work; the skill is choosing.

Question 2 — a. A SIM swap happens at the carrier, so the carrier account PIN is the direct defense, and moving away from text-message codes means a hijacked number unlocks less. A screen-lock passcode (b) protects the phone in your hand, not your number at the carrier. Bluetooth (c) and antivirus (d) have nothing to do with a carrier moving your number.

Key Takeaways

Your phone is your main device, a main scam channel and the key to many accounts, so secure it on purpose.
Turn on automatic updates, use a screen lock of at least six digits, and install apps only from official stores.
Review app permissions regularly and remove anything an app does not need.
Protect the main account behind your phone and switch on lost-device controls before you need them.
Set a carrier account PIN and prefer app-based codes or passkeys over text-message codes to defend against SIM swaps.

Sources

PreviousBackups That Survive Ransomware: The 3-2-1 Rule NextHTTPS and the Padlock: What It Proves and What It Doesn't