Dr. Seungwon Shin is VP and Head of the Security Team, Mobile eXperience Business at Samsung Electronics. He has led security innovations across the Samsung Galaxy ecosystem, including the development of secure AP and Samsung Knox Vault. He also oversees Samsung’s response to on-going security threats with real-time protectionand threat predictions, in close collaboration with partners and the broader research community. He is a member of the INTERPOL DarkNet Working Group as well as the Chair of the FIDO Korea Working Group. Before joining Samsung, he was an Associate Professor in the School of Electrical Engineering at KAIST, specializing in the Dark Web.
Today, We Get To Pick His Brain On The What’s What About Better Mobile Privacy Through Security
It’s hard to imagine a better time for cyber-criminals. The conditions are ideal right now for anyone with ill intentions and technical know-how.
A rise in remote workers means more reliance on unsecure public Wi-Fi. New frontiers like the blockchain leave confused customers ripe for scams. Cyber-attacks are on the rise. And not just where you expect them. Recent wars have started with digital attacks on critical infrastructure, months before physical incursion.
All this when we are putting more of our lives into our smartphones. They are our wallets, house keys, IDs. A single intrusion can be devastating so now more than ever we need our devices to be secure. Let’s examine what truly makes a device safe – so you can go out into the world and live freely, without worrying about your data getting into the wrong hands.
What Security Is… and What It Isn’t
By now you’re likely thinking you’re fine, because you’re sensible. But there are many common misconceptions about security. You don’t let apps share your name, email, or habits. You even disable app tracking permissions. Great, but that doesn’t mean your data’s safe. Please don’t confuse privacy for security. Closing your curtains will do no good if someone kicks your door down. You think you have chosen a safe mobile ecosystem, like a walled garden. But hackers adapt to their targets. Unsecure Wi-Fi, social engineering scams – these are threats regardless of what ecosystem you use.
You don’t open suspicious attachments. Great, but there are ‘zero-click’ attacks, which compromise a device without user interaction. That happened with Pegasus, spyware that exploited a flaw in a popular messaging system. All it took was for users to receive a message, and the hackers got in. Feeling safer than you are leads to complacency – that’s what cyber-criminals are counting on.
It’s unsettling to think that there are so many threats and no safe harbor. But that’s what inspires our work on Samsung Knox, our industry-leading, defense-grade security platform approved by many governments around the world. We achieved that level of trust through a holistic, multi-layered approach to protection: open collaboration, hardware and software integrated security, and real-time protection.
Trust Through Collaboration
If there’s one thing I’ve learned from my work with INTERPOL, it is that we are stronger and safer if we work with each other. Trust is built through open collaboration. That’s one of the great advantages of the Android ecosystem. Anyone can have access to the source code of Android OS, which allows it to be strengthened collectively. It allows some of the biggest names in tech to check and challenge each other – and work together to step up their game.
Samsung prides itself on this open model of partnership and collaboration, on top of our internal work to constantly strengthen our systems. That’s why we have worked closely with Google, and we have regular security issue meetings to share all threat data with each other. We also work with hundreds of partners to standardize security for Android.
Samsung Galaxy devices themselves also benefit from a wide community of people who understand our ecosystem. We work with academics and white hat hackers through our Mobile Security Rewards Program to identify and patch potential vulnerabilities through our regular security updates, and have awarded over $3.5 million worth of bounties to reward them for their valuable collaboration.
This way, we can better identify flaws or even predict them before they become problematic. More eyes, more heads, better solutions. Opening our ecosystem has not led to more vulnerabilities, but to greater and more diverse security practices.
An Integrated End-to-End Approach
It’s not just about software. We keep our watchful eye on each component from the processor up – we can do that as a leading global company that designs and manufactures its own products. You’re secure from day one, thanks to security-specific hardware and isolated software integrated across our portfolio and supply chain. That’s why we can be confident in the integrity of our devices: end-to-end protection at all levels of the mobile experience, from the chips inside to the apps you use.
As the world opens back up there are new risks to look out for. This is why we recently took things to the next level with Knox Vault, which combines the Secure Processor with a new Secure Memory Chip, to isolate the most critical information (such as PINs, passwords, biometrics, digital certificates, cryptographic keys) from the rest of the device to make sure it never gets into the wrong hands. For example, if a major security risk is detected on the device, Samsung Knox will lock down sensitive services such as Samsung Pay and Samsung Pass, to keep your data as it should be: for your eyes only.
Protection at All Times
If you’re anything like me, you rarely turn your phone off. That’s how some people get in trouble: some companies believe it’s enough to run security verification only when the phone boots up. That’s why we defend your mobile experience even after the boot up stage. Attackers never rest, so why should we?
We are committed to offering you real-time protection. After booting, our RKP (Real-Time Kernel Protection) and DEFEX (Defeat Exploit) technologies continuously work to detect and prevent suspicious or unauthorized changes to the permissions you gave. We monitor threats constantly and even have an Incident Response and Management team in place, which uses machine learning to predict future threats.
And while a lot of people buy new phones every year, many like to hold on to their phones for longer periods. That’s why we release regular security updates to patch any vulnerabilities, for up to five years after the launch of your device. In this ever-changing landscape of cyber-security, people who want to use their phones for as long as possible should be as safe as those with the latest models.
The Privacy You Want, The Security You Need
Put it all together and you have a mobile experience secure enough for world leaders. This is a foundation of security built with open collaboration and industry validation, backed up by the toughest hardware and software protections we’ve ever created. This is the security you need.
Only with that comprehensive security in place can anyone truly offer privacy that is as transparent as it is tailored to your priorities. What you do with that privacy is your choice. You’re free to create your mobile experience exactly as you like it, knowing we’ll always be there to keep you safe.
The world is more connected than ever, and there are more risks. But there are also more opportunities. Our priority is to keep you protected while you explore new experiences. With Samsung Galaxy, you’re free to live your life – with the privacy you want and the security you need.
