September 29, 2008, 12:07 PM — As wireless devices become more numerous within businesses, their convenience will be counterbalanced by an increasing potential for security problems, according to a Gartner analyst.
New trends in the wireless industry are making it easier for hacking attacks, said John Girard, a Gartner vice president, who spoke at the IT Security Summit in London on Monday.
A few years ago, there was not a lot of standardization across wireless devices. Differing operating systems, differing implementations of mobile Java and even varying configurations among devices with the same operating system made it hard to write malicious code that ran on a wide array of devices, Girard said.
But that's changing as the quality control gets better on widely-used platforms such as Microsoft's Windows Mobile and the Symbian operating system, he said. That standardization makes it easier for attackers to write code that will run on many devices.
"The more your phone gets like a PC, the more it can host malicious code," Girard said. "People are getting used to sending out executable code."
Many of the attacks that have been traditionally plaguing desktop machines, such as phishing, will increasingly move to the mobile platform, Girard said. Also, users may be more tolerant of glitches on their mobile phones, which may be clues that a device has been infected or hacked.
That's problematic when enterprises begin installing business applications on mobile phones and carry data that is potentially valuable to attackers, Girard said.
"We're very quickly moving to the point where people really can do business on smartphones," Girard said.
Gartner is predicting that wireless ID theft and phishing attempts targeting mobile devices will become more and more prevalent throughout next year, Girard said.
Companies need to be sure before buying a fleet of mobile devices that those devices meet a minimum security specification. The security specification can be formulated by figuring out what kind of data the device will handle and what regulations a company is bound by under data protection law, Girard said.
If the hardware and software is secure when the device arrives, it makes it a lot easier to manage than trying to fix a device after it's in the field, Girard said.
Girard laid out a few key security points: Data on devices should be encrypted, proper identity and access controls should be implemented and intrusion prevention systems should used to ensure that rogue devices don't access sensitive information, he said.
