Faster, cheaper iPhone portends IT security headaches

Still, enterprise IT security pros probably won't have a choice whether they'll have to support the iPhone, Williams adds. In the past, IT was able to prohibit such personal devices from connecting to corporate networks, but not now, he added, because tech-savvy workers expect to use the latest in connectivity devices to get their job done.

"That opens a whole wealth of headaches to IT," he said. "Managing devices like the iPhone is not easy."

With 3G support, Apple opens the door for "malicious software to proliferate in the iPhone, just as it does on desktops and notebooks," Williams said.

The iPhone's support for GPS is also problematic, he said. Combining the iPhone's ability to receive email and GPS capabilities allows attackers "to send targeted email and adds a level of knowledge to the attacker, who knows where you're located," he said.

Dulaney said Apple's new support for WPA2 security protocol is positive. "It gives them a secure link over Wi-Fi in the enterprise," he said.

But he has some doubts about the iPhone's support for Cisco's IPsec VPN capability. "I'm not sure IT should give users unrestricted access to back-end applications via cell phone VPN -- most cell phone VPNs haven't worked that well," he said.

A better approach is to build dedicated applications that secure remote cell phone connectivity into enterprise data stores, he said.

"It's very hard to gauge how secure this product is for an enterprise application," he said. "We have some indication that just for email it's fine. But for other applications, it's still not clear how secure or not this device is."

See original article on scmagazineus.com

Copyright © SC Magazine, US edition

cheaperfasterheadachesiphoneitsecurity