Apple's iPhone a security nightmare for enterprises

Powered by SC Magazine

When Apple's iPhone hits the streets this week, two things are likely: It'll be widely successful - as Apple's other consumer products have been - and it'll pose unknown risks to enterprise networks wherever it shows up.

One security researcher has gone so far as to call the iPhone a "nightmare for security teams."

Andrew Storms, director of security operations for nCircle, said in his blog, "As the iPhone currently stands, it has no place in the enterprise network simply because it lacks enterprise security controls."

Apple's new consumer product "will be a problem, trying to figure out who is using it," said Neel Mehta, a team lead with IBM's Internet Security Systems advanced research team. He said that enterprises must "look for technology rather than putting in policies or banning the iPhone" from their systems if they wish to minimise the potential loss of data via the USB-connected device.

Enterprises should place the iPhone "on the list of storage devices not allowed in classified or highly sensitive areas," he said. While both Mehta and Storms point to the potential loss of intellectual property via the iPhone, they say it poses no more threat than any other USB-connected device such as the smart phones already on the market and in use by employees.

Features the iPhone has that other smart phones do not have are Apple's Mac OS X operating system and a full version of the Safari browser. Although OS X is considered to be more secure than Windows, the iPhone version is a smaller version.

The browsers on smart phones have fewer features than Safari will on the iPhone, making them "less of a target" for malware than the iPhone, Storms said.

Apple is also planning to release the iPhone without a software development kit (SDK), meaning the company expects developers to create applications for the iPhone via Web 2.0-based technologies such as Ajax to run on the Safari browser.

This has positive and negative implications, according to Storms.

On one hand, the lack of an SDK means third-party vendors can't develop security applications - anti-virus, firewall and virtual private network (VPN) - for the iPhone, noted Storms.

On the other, however, it also "restricts malware developers in their efforts to develop malware applications" for the iPhone, he said.

Apple's iPhone a security nightmare for enterprises
Top Stories
NewSat defaults on $26m in overdue Lockheed payments
Jabiru-1 satellite build hits further hurdles.
IBM denies plans to cut 112k jobs
But admits to further restructuring.
ATO investigates 25 tech giants in tax hunt
Prepared to take tax evaders to court.
Sign up to receive iTnews email bulletins
Latest Comments
Who do you trust most to protect your private data?

   |   View results
Your bank
Your insurance company
A technology company (Google, Facebook et al)
Your telco, ISP or utility
A retailer (Coles, Woolworths et al)
A Federal Government agency (ATO, Centrelink etc)
An Australian law enforcement agency (AFP, ASIO et al)
A State Government agency (Health dept, etc)

Do you support the abolition of the Office of the Information Commissioner?

   |   View results
I support shutting down the OAIC.
I DON'T support shutting the OAIC.