Security Architecture, Endpoint/Device Security, Endpoint/Device Security, Security Strategy, Plan, Budget, Endpoint/Device Security, Endpoint/Device Security, Endpoint/Device Security

Experts: Apple’s iPhone a possible security nightmare for enterprises

When Apple's iPhone hits the streets this week, two things are likely: It'll be widely successful - as Apple's other consumer products have been - and it'll pose unknown risks to enterprise networks wherever it shows up.

One security researcher has gone so far as to call the iPhone a "nightmare for security teams."

Andrew Storms, director of security operations for nCircle, said in his blog, "As the iPhone currently stands, it has no place in the enterprise network simply because it lacks enterprise security controls."

Apple's new consumer product "will be a problem, trying to figure out who is using it," said Neel Mehta, a team lead with IBM's Internet Security Systems advanced research team. He said that enterprises must "look for technology rather than putting in policies or banning the iPhone" from their systems if they wish to minimize the potential loss of data via the USB-connected device.

Enterprises should place the iPhone "on the list of storage devices not allowed in classified or highly sensitive areas," he said. While both Mehta and Storms point to the potential loss of intellectual property via the iPhone, they say it poses no more threat than any other USB-connected device such as the smart phones already on the market and in use by employees.

Features the iPhone has that other smart phones do not have are Apple's Mac OS X operating system and a full version of the Safari browser. Although OS X is considered to be more secure than Windows, the iPhone version is a smaller version.

The browsers on smart phones have fewer features than Safari will on the iPhone, making them "less of a target" for malware than the iPhone, Storms said.

Apple is also planning to release the iPhone without a software development kit (SDK), meaning the company expects developers to create applications for the iPhone via Web 2.0-based technologies such as Ajax to run on the Safari browser.

This has positive and negative implications, according to Storms.

On one hand, the lack of an SDK means third-party vendors can't develop security applications - anti-virus, firewall and virtual private network (VPN) - for the iPhone, noted Storms. On the other, however, it also "restricts malware developers in their efforts to develop malware applications" for the iPhone, he said.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.