Android security checklist: the basics

Why app permissions matter more than you think

Most phone security advice boils down to "set a strong password." In practice, though, the most common gap is permissions an app was granted once and nobody ever reviewed again: access to the camera, microphone, location, files. Starting with Android 6.0, the system uses a so‑called runtime permission model — "dangerous" permissions (contacts, camera, location, and so on) are requested not at install time but at the moment they're actually used, and the user can grant or revoke them separately for each app. Android 11 added the option to grant location, microphone, and camera access just once ("only this time"), and Android 13 split media file access into separate categories — photos, videos, audio — instead of access to the entire storage at once.

Practical step: open Settings → Privacy → Permission manager and go through the "Camera," "Microphone," and "Location" categories. For apps that don't need constant access (a photo editor or a chat app, say), set "Only while using the app" or "Ask every time" instead of "Allow all the time." Separately, check that automatic permission removal for long-unused apps is turned on — it's usually named something like "Remove permissions if app isn't used" and is normally enabled by default.

System updates and security patches

Monthly Android security patches close specific vulnerabilities, some of which are already being exploited in real attacks. You can check the date of the last patch in Settings → System → System update (or "About phone" → "Security update"). If the update date is several months behind the current one with no obvious explanation, it's worth checking for an update manually. It's just as important to keep the apps themselves up to date: turn on auto-update in Google Play, since fixes often ship not in a new Android version but in an update to a specific app or library.

Lock screen and biometrics

• Use a PIN of 6 digits or more, or an alphanumeric password, instead of a pattern lock — a pattern is easy to spot over someone's shoulder or reconstruct from smudges on the screen.
• Treat biometrics (fingerprint, face unlock) as a complement to a PIN rather than the sole method: biometrics are convenient, but they come with legal and technical unlock nuances that a code doesn't have.
• Turn off showing notification content on the lock screen — this closes off a leak of confirmation codes and messages if the phone is lost.

App sources and pre-install checks

Install apps primarily from Google Play and enable Google Play Protect scanning (Play Store → profile icon → Play Protect). If for some reason you need to install an APK outside the official store, check what permissions the app is requesting before installing — if a flashlight app wants access to your contacts and SMS, that's a reason to be cautious, not to tap "install" on autopilot.

Passwords and two-factor authentication

Current NIST guidance on digital identity management (SP 800-63B) shifts the focus away from mandatory password "complexity" (required special characters, digits, periodic changes without cause) and toward length and uniqueness: a long, unique passphrase for each service is, in practice, more resilient than a short password with a couple of symbols tacked on — and it's also easier to remember. Keeping dozens of unique passwords in your head isn't realistic, so a password manager is a sensible solution; the criteria for choosing one are covered in our guide on how to choose a reliable password manager.

It's also worth turning on two-factor authentication for at least your Google account and your email — those are the accounts most often used to recover access to everything else. How to do it, and why it's "not an extra step but actual protection," is covered in detail in our article on two-factor authentication.

Wi-Fi and network connections

Open, password-free networks in cafés, airports, and hotels don't encrypt traffic between your device and the access point — that's a convenient interception point within the same network. If you have to log into a banking app or your personal account over public Wi-Fi, it makes sense to use an encrypted connection on top of the network — for instance, the HamikVPN app for Android encrypts your device's traffic and reduces the risk of interception in exactly this kind of situation. More on the risks of public networks and other protective measures in our article on how to protect your data on public Wi-Fi.

Backups and Find My Device

Starting with Android 6, device storage encryption (file-based encryption) is enabled by default, so data on a lost phone can't be read without unlocking the screen — but that only works if you actually have a PIN or password set for the lock screen, not "swipe to unlock." A couple of things worth doing separately:

• Turn on "Find My Device" (Settings → Security → Find My Device) and check once that it actually locates your phone via android.com/find or a similar service.
• Set up backups of important data (Google One or a local encrypted copy), so losing the phone doesn't mean losing your photos and contacts.

If your phone is lost or stolen

1. Use "Find My Device" to remotely lock the phone and, if recovery isn't possible, initiate a data wipe.
2. Change your Google account password (or your main email) first — other services are usually tied to recovery through it.
3. Contact your mobile carrier to block the SIM card and prevent confirmation codes from being received by SMS on a new device.
4. Check the list of active sessions in your banking and other critical apps and sign out of any you don't recognize.

The 15-minute quick checklist

• Check the security patch date and turn on app auto-updates.
• Set a 6-digit-or-longer PIN instead of a pattern lock, and hide notification content on the lock screen.
• Go through the permission manager: camera, microphone, location — set to "only while using the app."
• Turn on Google Play Protect.
• Use long, unique passwords through a password manager, and turn on two-factor authentication for your Google account.
• Turn on "Find My Device" and check it once.
• On public Wi-Fi, use an encrypted connection for banking and work apps.

None of these steps replaces the others — they're a set of independent layers of protection, and applying them together is what cuts down the number of realistic attack scenarios. More on digital hygiene and privacy in the HamikVPN blog, and you can check out the Android app itself on the HamikVPN app page.