iPhones and Smartphones: A Growing Threat to Network Security

iPhones and Smartphones:

A Growing Threat to Network Security

Recently with the growing rise of iPods, tablets and smartphones network security specialists have had a whole new way their networks can be compromised.  The obvious threat of someone taking data from the network using these storage and mobile computing devices is more obvious than is the threat of viruses now that can spread to iPhones and other smart devices:

From: http://www.csoonline.com/article/714053/iphone-sms-bug-said-to-be-serious-threat

The hacker, who calls himself "pod2g" and is best known for jailbreaking iPhones, said Friday that the vulnerability could let an attacker send a message pretending to be from a bank, credit card company or other trusted source.

Because the flaw does not involve code execution, an attacker does not need to get malware pass Apple, which approves all mobile apps before they are sold on the App Store, the only legitimate site for downloading software for Apple mobile devices.

Pod2g, a self-professed iPhone security researcher, said the flaw is "severe" and affects all current versions of iOS and iOS 6 beta 4. IOS is the iPhone and iPad operating system.

This is a serious threat to network security, if a virus can be spread by SMS to smartphones, what if it can be spread to computers as well?  Then anytime a computer had this iPhone plugged into it, even to just download a song, that computer would be infected.  How do you manage the computer access when these devices are just a USB port away from compromising the security of the whole network?  

From:  http://www.darkreading.com/security-monitoring/167901086/security/security-management/240151594/monitoring-the-nomads-in-your-network.html

At the most basic level, companies can monitor the devices that connect to their network. Companies can track which devices connect to their internal systems, which means treating a phone no differently than a laptop, desktop, or server, says Tyler Lessard, chief marketing officer at Fixmo, a mobile-device security firm.

"You can allow any user to access the network, but then say, 'I'm going to watch what devices are coming in, and if any of them look like they are potentially malicious or bad, then I might go out and react to it,'" Lessard says.

This most basic level of monitoring has the benefit of being inexpensive. The necessary data could be culled from firewall logs, but companies would benefit from more tailored systems designed to alert in real time.

Unfortunately, as stated above, firewalls aren't the most reliable form of security. So network admins are looking for new tools to deal with this.  

Traveling further up the security food chain, companies can focus on both the users and the devices. Companies that do not allow their users to access sensitive data on their devices--limiting access, say, to ActiveSync's e-mail and calendar services--could potentially just register each device with a mobile-device management (MDM) system and assign each user a certificate to access the network.

Companies that want to control the devices, but not necessarily the applications on the devices, should require that each user register their device with the MDM software. While turning off access for all unregistered devices may work in theory, IT departments will be more successful using a carrot-and-stick approach: Giving each user, say, 30 days to register their devices before cutting them off, and granting additional benefits--such as VPN access or to users that finish the enrollment process, says Ahmed Datoo, vice product of product marketing at Citrix.

"So there is no way for them to get e-mail unless they enroll their device--that is the stick approach," Datoo says. "You give them a warning, and there is an amnesty period."

This with the added ability to allow users to only access certain data under certain user accounts, restrict ports and also prevent users from using unauthorized devices on the network this is a very strong solution.  The only problem is this solution isn't cheap.  This solution should come down in cost as Moore's law progresses.