Apple's iPhone a security nightmare for enterprises

Powered by SC Magazine

When Apple's iPhone hits the streets this week, two things are likely: It'll be widely successful - as Apple's other consumer products have been - and it'll pose unknown risks to enterprise networks wherever it shows up.

One security researcher has gone so far as to call the iPhone a "nightmare for security teams."

Andrew Storms, director of security operations for nCircle, said in his blog, "As the iPhone currently stands, it has no place in the enterprise network simply because it lacks enterprise security controls."

Apple's new consumer product "will be a problem, trying to figure out who is using it," said Neel Mehta, a team lead with IBM's Internet Security Systems advanced research team. He said that enterprises must "look for technology rather than putting in policies or banning the iPhone" from their systems if they wish to minimise the potential loss of data via the USB-connected device.

Enterprises should place the iPhone "on the list of storage devices not allowed in classified or highly sensitive areas," he said. While both Mehta and Storms point to the potential loss of intellectual property via the iPhone, they say it poses no more threat than any other USB-connected device such as the smart phones already on the market and in use by employees.

Features the iPhone has that other smart phones do not have are Apple's Mac OS X operating system and a full version of the Safari browser. Although OS X is considered to be more secure than Windows, the iPhone version is a smaller version.

The browsers on smart phones have fewer features than Safari will on the iPhone, making them "less of a target" for malware than the iPhone, Storms said.

Apple is also planning to release the iPhone without a software development kit (SDK), meaning the company expects developers to create applications for the iPhone via Web 2.0-based technologies such as Ajax to run on the Safari browser.

This has positive and negative implications, according to Storms.

On one hand, the lack of an SDK means third-party vendors can't develop security applications - anti-virus, firewall and virtual private network (VPN) - for the iPhone, noted Storms.

On the other, however, it also "restricts malware developers in their efforts to develop malware applications" for the iPhone, he said.

Apple's iPhone a security nightmare for enterprises
Top Stories
Making a case for collaboration
[Blog post] Tap into your company’s people power.
Five zero-cost ways to improve MySQL performance
How to easily boost MySQL throughput by up to 5x.
Tracking the year of CIO churn
[Blog post] Who shone through in 12 months of disruption?
Sign up to receive iTnews email bulletins
Latest Comments
Which is the most prevalent cyber attack method your organisation faces?

   |   View results
Phishing and social engineering
Advanced persistent threats
Unpatched or unsupported software vulnerabilities
Denial of service attacks
Insider threats