Apple's iPhone a security nightmare for enterprises

Powered by SC Magazine

When Apple's iPhone hits the streets this week, two things are likely: It'll be widely successful - as Apple's other consumer products have been - and it'll pose unknown risks to enterprise networks wherever it shows up.

One security researcher has gone so far as to call the iPhone a "nightmare for security teams."

Andrew Storms, director of security operations for nCircle, said in his blog, "As the iPhone currently stands, it has no place in the enterprise network simply because it lacks enterprise security controls."

Apple's new consumer product "will be a problem, trying to figure out who is using it," said Neel Mehta, a team lead with IBM's Internet Security Systems advanced research team. He said that enterprises must "look for technology rather than putting in policies or banning the iPhone" from their systems if they wish to minimise the potential loss of data via the USB-connected device.

Enterprises should place the iPhone "on the list of storage devices not allowed in classified or highly sensitive areas," he said. While both Mehta and Storms point to the potential loss of intellectual property via the iPhone, they say it poses no more threat than any other USB-connected device such as the smart phones already on the market and in use by employees.

Features the iPhone has that other smart phones do not have are Apple's Mac OS X operating system and a full version of the Safari browser. Although OS X is considered to be more secure than Windows, the iPhone version is a smaller version.

The browsers on smart phones have fewer features than Safari will on the iPhone, making them "less of a target" for malware than the iPhone, Storms said.

Apple is also planning to release the iPhone without a software development kit (SDK), meaning the company expects developers to create applications for the iPhone via Web 2.0-based technologies such as Ajax to run on the Safari browser.

This has positive and negative implications, according to Storms.

On one hand, the lack of an SDK means third-party vendors can't develop security applications - anti-virus, firewall and virtual private network (VPN) - for the iPhone, noted Storms.

On the other, however, it also "restricts malware developers in their efforts to develop malware applications" for the iPhone, he said.

Apple's iPhone a security nightmare for enterprises
Top Stories
Meet FABACUS, Westpac's first computer
GE225 operators celebrate gold anniversary.
NSW Govt gets ready to throw out the floppy disks
[Opinion] Dominic Perrottet says its time for government to catch up.
iiNet facing new copyright battle with Hollywood
Fighting to protect customer details.
Sign up to receive iTnews email bulletins
Latest Comments
In which area is your IT shop hiring the most staff?

   |   View results
IT security and risk
Sourcing and strategy
IT infrastructure (servers, storage, networking)
End user computing (desktops, mobiles, apps)
Software development

Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results