Security policies drawn up in the days of mainframes aren`t adequate in today`s increasingly mobile world, says John Pescatore, VP and research director at Gartner USA.
Pescatore says workers are increasingly using personal digital assistants (PDAs) in their jobs, and corporations must actively support these devices if they hope to retain control over their data and network integrity.
He notes that too often people worry only about the over-the-air portion of the wireless model and not enough about the device itself.
"Protecting the over-the-air signal is only one part of wireless security. Making sure the data on the device is safe from viewing by an unauthorised person who has got hold of the cellphone, laptop or PDA is critical." This is also important in ensuring that only authorised users have access to the corporate network.
Pescatore explains that there are many security challenges as businesses move into mobile devices, the most important of these being authentication and the inherent security holes in the browser model. He believes that although the thin client approach with a browser interface is the "superior architecture" because less information is stored locally on the device, the downside is that it means the "loss of the ability to work offline".
As mobile workers move between networks, their laptops and handheld devices often became vulnerable through changing security scenarios. A typical example, he says, is workers who have the Netbios port on their laptops open for internal sharing which, when used from home over the Internet, becomes a gaping vulnerability.
When drawing up security policies, it is important to "avoid policies that hinge on user decisions". The standards should instead be adhered to across the enterprise, particularly with regards to synchronisation of mobile devices.
"Formally support PDAs and other mobile devices," he advises. More and more workers are in possession of PDAs and mobile phones, which, if not controlled, become a significant security risk. Instead of allowing staff to use their own choice of device, enforce a PDA standard and ensure that each device is configured with a similar corporate image, he says.
According to Pescatore, the increasing usage of 802.11 wireless standards pose an array of new threats to corporations, and while "wireless can`t be ignored, hackers are finding a new bonanza in the wireless world".
He says the inherent weakness in radio-based networking is its physical accessibility, as well as the ease with which impostors can pose as legitimate access points and lure in unsuspecting users. He advises that wireless sniffers be used regularly to detect rogue access points, and that all wireless communications are tunnelled through VPNs.
With a growing proliferation of wireless access, Pescatore says, it is important to educate users on the threats of wireless networking as well as setting strict policies on what they can and cannot do.
Pescatore believes that one of the major challenges to corporations today is that most mobile workers carry an average of three devices - a situation he doesn`t see changing for the next three years.
He concludes that corporations should investigate multi-channel network gateways to support different devices because "they provide consistent security across all devices".
Share
