As wireless communication becomes increasingly commonplace in the workplace thanks to falling prices and the flexibility the technology provides, enterprises must be conscious of the security issues involved as they move from wired connections to wireless ones, cautions John Pescatore, vice president and research fellow with Gartner, Inc. in Stamford, Connecticut.
One of the biggest concerns is the increasing ubiquity of “smart” handheld devices, which are basically tiny PCs with many of the same capabilities–and many of the same security threats from worms, viruses, and targeted malware attacks.
Additionally, as more smart devices empower mobile users to accept and launch applications from other mobile devices, it makes the devices that much more susceptible to phishing, rootkit, botnet, and targeted malware attacks.
Solutions Available
It’s not all that difficult to build in security when adding mobile solutions, Pescatore said, though there is no single solution to address the most potentially damaging threats, so firms will have to rely on multiple security products.
Insiders will be the source of 60 percent of targeted attacks, Pescatore warns. “Being aware of ‘inside out’ communications and being able to block those as effectively as ‘outside in’ communications is becoming increasingly important.”
When establishing wireless security controls, Pescatore recommends firms follow the standard of “due care,” which is how courts measure most of the subjective criteria (such as the sufficiency of controls) in enforcement actions.
“Meeting the standard of due care can be vital in protecting the organization from civil and legal liability,” Pescatore said. “In short, the way to meet the standard of due care is to do at least what most companies in your industry sector are doing.”
Powerful Devices, Vulnerabilities
To prevent attacks from succeeding, Pescatore recommends firms perform wireless intrusion detection tests to uncover rogue access points, foreign devices connecting to corporate access points, and accidental association with nearby access points in use by other companies.
“Periodic probing of the network for rogue access points is not enough,” Pescatore said. Firms should “consider deploying sensors that continually monitor the air for intrusion.” — Phillip J. Britt
