About mobile security Post #1
I commented a question about mobile security couple of days ago, and I decided to wrap up the comments here as well.
IMHO: There is no single "silver bullet" to answer what to do and how-to solve smartphone security. There are at least two major dimensions to the topic. #1 Maturity of Technology #2 Legacy from Internet/PC culture. 1st issue, The Maturity of Smartphones, is significant because Smartphones have introduced new or significantly revamped OS platform(s) in parallel with a new way of doing things aka. innovating new application areas, behavioral patterns and high level expectations for User Experience ("UX"). At the same time the end users and owners of the devices are more and more non-tecchies, non-pro ICT people thus re-opening doors for old attacks such as "social engineering" etc. Lots of the security problems are coming from application design issues with combination of lack of education of end-users. 2nd issue, The Legacy of Internet and PC culture, is limiting the ability to solve some of the smartphone related issues. In short, Internet approach was not initially designed for "bulk home appliances" and standard "home users". Actually only IPv6, in theory, adds the ground-work that enables solving of the most critical issues. On the other hand, for daily use IPv6 is more or less "heavy lifting" and it will take some time before it is widely enough implemented to enable new innovations to gain momentum in the are of security. In the mean while industry has been introducing new, more consumer friendly utlities, such as the UPnP, which on the other hand, introduces new potential security related risks. So, what is needed to improve the smartphone (or Xbox, or dTV, or Toaster and Coffee Machine) related security? Educating the users is the #1 issue. This is same both in business and home. Especially now when the BYOT is still gaining share despite the well known risks.
People must learn to understand that being in Facebook and owning a Smartphone adds risk, but there are ways of doing things in the way that reduces risks significantly. IMHO #2 in solving the issue is that The Industry recognizes that there are serious risks that have not materialized (yet). The news we have seen this far are just the tip of the iceberg -- ask anyone who is working in the area of an ICT security today. It is also quite obvious that new way of working and new "gizmos" enable new ways of misusing the information or attacking the end users privacy, finances etc. The traditional virus and malware protection are no more state of the art tools for protection.
As Industry, we are living more or less in between the Recognition and Denial phases of the process. Industry as a whole is telling that "it's OK, just a random event, that someone stole your private data", or "it was your own fault that your password sucks". Industry, as a whole, is afraid that it might slow down the business if these things would be discussed widely and openly. (I disagree, we are dummy enough to do against what we would know to be the best). Only when we have handled the Denial, we can start the Approval and Change that will be needed. Why we are living in denial? That's the #3, and as it is more complex and kind of a "multi-symptom disease", it is easier to live in denial and wait someone else to fix it. What makes the complexity? Customer Expectations - Business Drivers - Speed of Change - Complexity of Technology etc. So, in short, we're back to square #1 aka. Maturity of the technology. Actually, one more analogy came to my mind: Smartphone security (today) is like a MDR/MRS in medicine: The Bacteria evolves faster than the drugs you have available. What can I do myself to help: Well, I will Educate myself to understand how to minimize the risks, AND I will act as a Customer to influence the market to speed up better solutions in this area. But just remember: The Biggest threat to security has been, and will be, the person using the technology (right or wrong, does not matter). So, what is the real difference in between current PC and Smartphone security? technically next to none, in practices the difference is more than 10 years gap of Education. You must remember that significant share of Smartphones users have have been born in the era of (digital) Mobile Phones (1991 or so).Significant share of consumers using Smartphones today hadn't even been born when GSM did not exist!
//J
