A host of issues exist concerning mobile security; from physical security to encryption, to the still-developing realm of wireless viruses, there are any number of obstacles to secure wireless usage. In this article from InformIT, Chris Bennett examines each of these issues and a few of the solutions available.
Mobile applications share most of the security issues of traditional networked applications. These include authentication of devices and users, hiding information from prying eyes using encryption, viruses, and access control. However, the mobile world adds some unique issues to the already complex security arena. Mobile devices are easily misplaced or stolen, so physical security is important. Information that is usually confined behind a corporate firewall is now winging its way through the air, possibly spending some time on hosted servers or wireless gateways. If your solution uses a wireless LAN (WLAN) for connectivity, there are a host of WLAN-specific security issues that are currently making consultants a lot of money. Although in its infancy, the hacking of mobile devices (even cell phones!) has begun.
Losing a laptop or hand-held can have a huge impact, not just on an individual, but also on their organization. Confidential data is rarely secured beyond simple user password protection, and there are commonly available tools to defeat this protection. Perhaps the most obvious way to deal with this is a physical lock. Already common in the laptop world, cable locks such as the Kensington products can protect hand-helds as well. Another important step is to track devices and tag them to allow easier recovery in the event of loss or theft. In an estimate for 2001, the Gartner Group stated that 250,000 cell phones and hand-helds would be lost in airports alone, and that less than 30 percent would be recovered.
Most operating systems support login passwords (although in earlier versions of Windows, they do not necessarily protect your files from prying eyes). Palm offers password protection on its PDAs that (on some versions of its operating system) can be bypassed by anyone who has physical access to the device. Some security experts have stated that the Palm OS is not inherently secure, and highly sensitive information should not be stored on these devices. However, products are available that improve Palm security.
A good compromise between ease of use and total security is to encrypt selected confidential or sensitive files. Certicom offers encryption tools for Palms and Pocket PCs, and some product vendors build encryption right into their products. Hardware encryption of Compact Flash (CF) and PC cards is another option; Casio offers hardware encryption in its CF cards. Even if your data does not fall into the wrong hands, loss of critical information can be costly. Synchronizing and backing up hand-helds and laptops at regular intervals will help to protect against this.
Because e-mail has become so pivotal to organizations, it is critical that security issues be addressed when extending access to the mobile user. There are a variety of secure corporate e-mail solutions for mobile use, typically relying on a server or desktop software installation to provide end-to-end security. The Blackberry enterprise e-mail solutions from Research In Motion are good examples of this. Be careful of ad hoc e-mail solutions that rely on forwarding e-mail to a public ISP's mail server. Although this solution is flexible (allowing retrieval of e-mail via laptop or hand-held), it exposes corporate information both on the ISP's infrastructure and during transmission over the Internet.
Viruses are not currently a huge concern in the hand-held world, although Trojan horses and simple viruses have begun to appear. The major antivirus vendors (Symantec, Computer Associates, and McAfee) have products designed specifically for the mobile and wireless realm. Some of them are focused on protecting the mobile device; others focus on protecting the enterprise from viruses when a mobile device is synchronized.
Hosting a mobile application with an application service provider (ASP) has inherent security and confidentiality risks. Because security is such a hot topic, most ASPs will cover this issue explicitly in their collateral, and it should be a major consideration when evaluating their offerings. Although highly secure applications may rule out an ASP solution altogether, one way to overcome concerns is to use a virtual private network (VPN). In a VPN, the hosted infrastructure simply supports a secure tunnel between the client devices and the enterprise. Certicom offers VPN solutions for mobile applications.
To read the entire article from which this tip comes, click over to InformIT. You don't have to register or jump through any hoops. All you do is get the info you want.
