Unit 1: How phones are built to defend · Lesson 2 of 5 · 20 min
The secure element and your passcode
Find which chip guards the keys on each phone, and why the state after a reboot matters.
mission
- You are
- You are the IT analyst at Kestrel Field Services.
- Situation
- Legal asks a simple question: if a field phone is stolen from a van, can the thief read the job photos and customer addresses on it?
- Goal
- Explain, phone by phone, what protects the data at rest.
- Hand in
- Which chip guards each phone, and what the passcode policy must be.
A phone with its layers lifted
Every modern iPhone and Android phone encrypts its storage. The key is wrapped by a secure element and by your passcode, and the secure element limits how fast anyone can guess.
Find the guard chip for a model
Open the Hardware tab and filter for Galaxy. Newer Galaxy models use Knox Vault, Pixels use Titan M2, iPhones use the Secure Enclave.
you should see Every model in the fleet has a hardware element, which is the baseline you should expect.
Join the inventory to the hardware
Switch to the Inventory tab and find Mei Chen's phone, then look its model up in Hardware.
you should see A Pixel 8a with a Tensor G3 and Titan M2.
Know the two states after power on
Before first unlock (BFU) the keys stay locked inside the secure element. After first unlock (AFU) they are in use until the phone restarts.
you should see A stolen phone in BFU is far harder to attack than one in AFU.
defender tip iPhones restart themselves after 72 hours locked (since iOS 18.1). Google added the same three day restart to Android through a Play services update in 2025. Both push a lost phone back to BFU.
Spot the newest protection
Sort the Hardware tab by Memory tagging hardware. iPhone 17 models add Memory Integrity Enforcement, and Pixel 8 and later carry memory tagging used by Advanced Protection.
you should see A handful of models can stop whole classes of memory bugs used by spyware.
Passcode policy
4 digits No auto-lock Swipe to unlock on a field tablet
The secure element slows guessing, but 10,000 options is still small.
6 digits or more, or alphanumeric Auto-lock 2 minutes Biometrics on top for convenience
Enforced by MDM, not by hope.
What a defender takes away
- 1Encryption is on by default. The passcode and secure element make it real.
- 2A powered-off or freshly restarted phone is in its strongest state.
- 3Hardware memory protections are a reason to buy newer models for high-risk staff.
Questions
0 of 4 solved
Answer each one from what you find on your lab machine.