With increasingly powerful mobile devices selling in large numbers and software development kits readily available, the mobile device scene has all the hallmarks of a classic malware environment. Kids who hack smartphones for fun and fame will be joined by those who abuse these devices for profit. Perhaps the biggest difference from historic malware scenarios today is the existence of a readily accessible market of stolen data and compromised hosts -- and yes, mobile devices are hosts.
We can expect mobile device attacks that target the following:
1. Confidential data stored on the device.
2. Confidential data transmitted to and from the device.
3. Services enabled by the device.
As an enterprise security rule, we can assume that the smarter the device, the more complex, valuable and voluminous the data stored on it is; likewise the data sent to and from the handheld. Another rule of thumb tells us that newer devices prove to be less secure than more mature devices. Put the two rules together, and you have ample reason to think that mobile attacks will be heavily focused on the stored data sent to and from the device.
The wild card may be point three, the services enabled by smartphones. Historically, phone companies have had the most complete and sophisticated network traffic-monitoring and control systems. They may be able to prevent the abuse of connectivity better than the loose-knit patchwork of ISPs who formed the basis of the Internet. If mature technology is not used, you can expect to see some serious and widespread attempts to turn high-speed, always-on mobile devices into botnets.
At the moment, the biggest threats posed by "smart" devices are probably the simplest and oldest: the handhelds get easily lost and stolen, along with the data they contain; people talk too loudly on them, with too little awareness of who might be listening or "shoulder surfing"; people check email with the devices insecurely, exposing passwords and content. There will definitely be sophisticated threats in the future, and the future may be sooner than we expect.
Dig Deeper on Handheld and Mobile Device Security Best Practices
Related Q&A from Michael Cobb
A new programming language called Wyvern is helping developers use multiple languages in one app securely. Application security expert Michael Cobb ...continue reading
Gartner predicts more than half of all mobile apps will use HTML5 by 2016, but what threats will this cause the enterprise? Expert Michael Cobb ...continue reading
Public key pinning aims to reduce the lack of trust associated with digital certificates and certificate authorities. Expert Michael Cobb explains ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.