Mobile Security Isn't Going to Just Happen
Security professionals need to get hands-on with the software that runs on mobile devices and engage with the developers who put all those apps in users' hands.
Tue, May 24, 2011
Computerworld — The future is mobile, folks. The real question is, Are you ready for it? Really ready for it?
I've spent the better part of the last six months learning and studying all I could about the iOS and Android worlds. For all sorts of reasons, I firmly believe that these platforms are going to be integral to our computing needs well into the future. The combination of hardware speed, size and availability, along with the maturity of the software, shows that the time is now.
Slideshow: Mobile Security: How Gadgets Evolved
Of course, that's no great revelation. Anyone even remotely watching the IT world would have to know that mobile devices have been having significant impact for some time now.
But what does all this have to do with security ? Well, despite the many innovations that were necessary to create our mobile world, there are many aspects of today's mobile platforms that represent significant steps backwards, at least from a security perspective. Despite their Unix-derived lineage, most of today's mobile platforms are basically single-user systems, with all the security of Windows 3. OK, Windows 95 ... but little else. (Running all iOS apps as root? Seriously, Apple ? What were you thinking?)
There's much to be done in the area of security for our mobile systems.
So, just how do we go about making mobile systems more secure? To answer that, we need first to take a brief look at how the IT security community has fared over the past few decades. Most significantly, since the explosive growth of the Internet got under way in the mid-1990s (largely due to the Web), we've been focusing our attention on applying add-ons to try to secure our systems.
We've built firewalls to put in front of our systems. We've developed intrusion detection (and "prevention") systems to watch over our systems. We've put antivirus and personal security products on our desktops and laptops. We keep on adding security products to our systems, but the problems continue to get worse every year, not better.
You see, all these add-on approaches amount to rearguard actions, with fixes applied after the fact. By any objective measure, these practices haven't done much to protect us from each novel attack that has come along.
One of the principal reasons for all these failures is that our software is broken. We use antivirus software because the operating systems have failed to protect us. We use firewalls because our applications fail to protect themselves. And so on.
