Results 1 to 8 of 8

Thread: PDA and Handheld Security

  1. #1
    Macht Nicht Aus moxnix's Avatar
    Join Date
    May 2002
    Location
    Huson Mt.
    Posts
    1,752

    PDA and Handheld Security

    With the advent and propigation of hand held device, the security of corperate enterprise networks are at risk. Any organization that uses or allows the use of these devices have a new worry and of course the headache that goes with it.
    Not only do you have to consider the increase need for physical security, but also the security of your data that may be in these devices.
    With all three stages, but especially at stage three, data security should be a major concern. With portability come increased odds that a device will be lost or stolen. The mobile device might contain highly sensitive, proprietary corporate data, such as engineering documents, internal applications, client lists, or even just internal phone lists. If you're at stage one, security is hard to enforce; but even here, you should have a policy of requiring on-device encryption and access controls. Devices typically support at least passwords at power-on. Hewlett-Packard, like some other vendors, has begun putting biometric authentication devices on high-end iPaq units. PDAs now on the market include the capability to automatically encrypt data on the handheld, which should help keep your data out of unfriendly hands.



    Policies will be difficult to enforce on devices that you don't own or control. However, if you allow employees to put company data on personally owned devices, at minimum IT has a clear mandate to enforce a clearly communicated security policy.

    At stages two and three, security is theoretically easier to enforce since your organization has procured and configured the devices. But typically, PDAs are extremely open to reconfiguration by users who like to install a variety of third-party programs. One option is to deploy a full-fledged mobile system management package, such as Mobile Automation's management suite or XcelleNet's Afaria. This is a rather complex, but centralized way to manage which software and configurations are on each device. It will allow you to do remote inventory and configuration management, such as pushing a new version of a database to PDA users whenever they synchronize.
    The need for strong passwords and data encryption, plus some strong physical security awareness are mandantory for anyone using a PDA device that carries propriatary data within it.
    The referrence artical came from here: Full Artical
    \"Life should NOT be a journey to the grave with the intention of arriving safely in an attractive and well preserved body, but rather to skid in sideways, Champagne in one hand - strawberries in the other, body thoroughly used up, totally worn out and screaming WOO HOO - What a Ride!\"
    Author Unknown

  2. #2
    AO Ancient: Team Leader
    Join Date
    Oct 2002
    Posts
    5,197
    PDA security is a problem since "confidential" data can be moved to it..... It's one of those "overlooked" things right now..... They can take things out of the network that you might not want them to or, worse yet, they can bring things in..... Difficult subject when you have users that think they know what they are doing..... I allow on a user by user basis... I haven't denied one yet..... That doesn't mean I won't deny one someday.....
    Don\'t SYN us.... We\'ll SYN you.....
    \"A nation that draws too broad a difference between its scholars and its warriors will have its thinking done by cowards, and its fighting done by fools.\" - Thucydides

  3. #3
    Regal Making Handler
    Join Date
    Jun 2002
    Posts
    1,668
    Nothing but questions here.
    1/is there a worm that can access pda and propagate.
    2is there virus that can damge and run on a pda.
    3/is there a trojan that can install and run from a pda.

    I ask these questions becouse i own one.
    What happens if a big asteroid hits the Earth? Judging from realistic simulations involving a sledge hammer and a common laboratory frog, we can assume it will be pretty bad. - Dave Barry

  4. #4
    Senior Member
    Join Date
    Aug 2003
    Posts
    1,018
    Jinxy, yes, yes, and yes.. some are old (relatively speaking), and they're just not as popular.

    http://techupdate.zdnet.com/techupda...620913,00.html
    http://techupdate.zdnet.com/techupda...631192,00.html

    How to get them:
    http://www.techtv.com/callforhelp/an...329073,00.html

    PDA Forensics:
    http://www.informit.com/guides/conte...rity&seqNum=64

    PDA security:
    http://www.intranetjournal.com/artic...04_07_03a.html

    I had a link to some apps for PDA data recovery, but I can't find them.

  5. #5
    Regal Making Handler
    Join Date
    Jun 2002
    Posts
    1,668
    Groovicus,
    You still have not proved to me that having a hand held running PPC2003. That i am likely to be a security risk to anyone.

    Symantec and Mcafee are just ahead of the game for now.

    Jinxy
    What happens if a big asteroid hits the Earth? Judging from realistic simulations involving a sledge hammer and a common laboratory frog, we can assume it will be pretty bad. - Dave Barry

  6. #6
    Macht Nicht Aus moxnix's Avatar
    Join Date
    May 2002
    Location
    Huson Mt.
    Posts
    1,752
    To expand a bit on the questions of PDA virus/worms and trojans, almost anything that connects to the internet or that is capable of opening attachments is capable of carrying malware. In fact anything that is capable of carrying files or data is capable of carrying malware.
    Even if it doesn't have the actual capabilities of running the malware, it can infect the base system when later connected to it. (thats supposing that you use a docking station or some other means to syncronize the files between your base system and PDA).
    \"Life should NOT be a journey to the grave with the intention of arriving safely in an attractive and well preserved body, but rather to skid in sideways, Champagne in one hand - strawberries in the other, body thoroughly used up, totally worn out and screaming WOO HOO - What a Ride!\"
    Author Unknown

  7. #7
    AO übergeek phishphreek's Avatar
    Join Date
    Jan 2002
    Posts
    4,325
    I find that some handheld devices have "plenty" of security.

    For instance:

    I have a palm T3. It doesn't have an internet connection (yet... I'm still waiting for SanDisk to release drivers.. gRRRR!). It does have bluetooth though. But, you must allow the connection. You and the person connecting must know the "key". Both users enter the key, then then they are connected. The sender has to initiate transfer. The receiver can not. Bluetooth doesn't communicate very far though... 30ft... You can also see on the front of the screen when it is in use. It doesn't work when the device is "sleeping". After 3min, it will autolock itself and encrypt everything in the internal memory. (64MB).

    My T3 also has encryption. When it locks out, it encrypts everything I tell it to. I believe I have it set on blowfish? If I enter the password wrong 3 times, it will reset the device to factory and erase everything on it. I've done it on accident...

    If you try to hotsync, it'll prompt you for the password. Enter password wrong 3 times... data is gone. (still on main PC though. So, next legitimate hotsync will restore databases/files/programs).

    Just make sure not to store any important data on the SD cards... that can be removed and put into another device. The only thing I put on there is music(mp3s) and pictures.

    Oh, it even has free antivirus!
    http://www.bitdefender.com/bd/site/p...s.php?p_id=23#

    It will only scan palm files though. If virus for another system is on it... it won't be detected...
    Quitmzilla is a firefox extension that gives you stats on how long you have quit smoking, how much money you\'ve saved, how much you haven\'t smoked and recent milestones. Very helpful for people who quit smoking and used to smoke at their computers... Helps out with the urges.

  8. #8
    AO Part Timer
    Join Date
    Feb 2003
    Posts
    331
    My T3 also has encryption. When it locks out, it encrypts everything I tell it to. I believe I have it set on blowfish? If I enter the password wrong 3 times, it will reset the device to factory and erase everything on it. I've done it on accident...
    Of subject, but on topic. This is an intersting tactic. I have considered it many times. But have never heard of it being used. Takes three strikes and your out to a new level. I've always felt this was a very good method of protection. With all the nice back up options around, this could actually prove good physical security on a machine.

    The admin at my work place has a problem with people using the clock in computers to do all sorts of stuff that was supposed to be restricted. For example, change the screen saver and background. I don't know for sure how they were doing it, but I have an idea.

    I pointed out that the machines had IE running. So either remove IE or block access to stuff like cmd, regedit, and notepad. He didn't follow so I showed him
    %systemroot%\system32\cmd.exe via IE. Then open regedit, removed HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer no run value.

    He suddenly realized his error. Good thing my admin is cool. I'd hate to be misunderstood by those whom I am trying to help. I also showed him how easy it is to create a *.reg file with notepad. Then a simple right click "merge".

    I then pointed out that unless it is completly needed he should remove the ability for a user to access his bios. Then he should take the floppy and cd out of boot.

    /highjack

    Back to topic. I guess what I am saying is anything is a threat. It really just depends on what you wish to stop. What OS you choose to use, and whom you give rights to. Don't overlook all the simple stuff. OR as I once heard. K.I.S.S. "keep it simple stupid.


    Be safe and stay free
    Your heart was talking, not your mind.
    -Tiger Shark

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •