Faster, cheaper iPhone portends IT security headaches

While the throngs are going crazy about the new Apple iPhone's lower cost and faster download speeds, IT professionals are gearing up for more security headaches from the Apple's latest smart phone.

The new 3G iPhone announced on Monday by CEO Steve Jobs at Apple's Worldwide Developers Conference will sell for US$199 for the 8GB model and US$299 for the 16GB model -- a US$200 discount on each model. That brings it within the reach of a much larger audience, including corporate users, according to analysts.

Moreover, the iPhone will support faster download over AT&T's 3G network, substantially enhancing users' web browsing experience. This makes the iPhone more appealing for workers accessing web-based enterprise applications via smart phone, Amrit Williams, CTO at vendor BigFix told SCMagazineUS.com.

That may be all well and good, but the new, faster iPhone models also portend problems for enterprise IT professionals who'll inevitably be forced to deal with them, Williams said. "What it boils down to, even though everyone is focusing on faster and cheaper, this creates a tipping point for a new era of mobile data threats and mobile malware," he said.

In addition, the iPhone lacks third-party verification that it is secure, no matter what Apple claims, Ken Dulaney, vice president and distinguished analyst at Gartner, told SCMagazineUS.com. "For Apple to say it's secure is one thing, but to have independent people with secure products is another," he said.Still, enterprise IT security pros probably won't have a choice whether they'll have to support the iPhone, Williams adds. In the past, IT was able to prohibit such personal devices from connecting to corporate networks, but not now, he added, because tech-savvy workers expect to use the latest in connectivity devices to get their job done.

"That opens a whole wealth of headaches to IT," he said. "Managing devices like the iPhone is not easy."

With 3G support, Apple opens the door for "malicious software to proliferate in the iPhone, just as it does on desktops and notebooks," Williams said.

The iPhone's support for GPS is also problematic, he said. Combining the iPhone's ability to receive email and GPS capabilities allows attackers "to send targeted email and adds a level of knowledge to the attacker, who knows where you're located," he said.

Dulaney said Apple's new support for WPA2 security protocol is positive. "It gives them a secure link over Wi-Fi in the enterprise," he said.

But he has some doubts about the iPhone's support for Cisco's IPsec VPN capability. "I'm not sure IT should give users unrestricted access to back-end applications via cell phone VPN -- most cell phone VPNs haven't worked that well," he said.

A better approach is to build dedicated applications that secure remote cell phone connectivity into enterprise data stores, he said.

"It's very hard to gauge how secure this product is for an enterprise application," he said. "We have some indication that just for email it's fine. But for other applications, it's still not clear how secure or not this device is."

See original article on scmagazineus.com