Are smartphones the next malware target?

Network World's article yesterday on 4G smartphone vulnerabilities (Securing 4G smartphones:

Added data capacity, connection speeds will make 4G smartphones more vulnerable) provides a glimpse into the next security battleground.

 

Mobile computing is vulnerable to cyberattack. Smartphones bring all of the security issues of the internet (that have been affecting your PC for years) to your phone. Denial of service attacks are a particular issue and they appear to be growing.  

 

Higher speeds and larger memory create a playground for malware, an attack mechanism for cloud applications, and greater risks for denial of service attacks:

 

But like all good things, this increase in speed and power comes with greater risks. Sanjay Beri, the vice president and general manager of Juniper's Access and Acceleration business unit, says that the money-stealing malware that appeared on Symbian-based phones last year is sadly a sign of things to come in the era of 4G.

"4G makes the situation more accelerated," he says. "And what will really accelerate the growth of mobile malware and spyware will be the volume of traffic that people will be able to use. Data usage will increase and there are going to be more places that will get infected."

This increased mobile data usage is only expected to intensify in the enterprise as more executives could try to use their favorite devices for both work and personal use. Mike Siegel, a senior director of product management at McAfee, says this will put a particular strain on IT departments' abilities to protect data across multiple operating systems and applications.

"We have senior executives now who are pushing on IT to support Android or iPhone," he says. "With iPhone and Android, you have a propagation of applications that have connections back to sensitive corporate data in the cloud. So these devices now are very much a data leakage vulnerability."

Smartphones add security risks to enterprise, government, and not-for-profit IT shops through the potential for loss of data, spying and disruption through denial of service attacks or other malware.  

They also add risks for individual through loss of privacy, loss of use (one denial of service attack launches applications that drain your smart phone battery - simple and effective), and theft.

What I don't like about proposed solutions is that they seem to require less privacy, slower response times and more user hassle. But without greater security it will be difficult and expensive to realize the full potential of Smartphones to transform our lives. Anyone with a Smartphone understands this.

If your phone could also securely carry money, credit or debit card information, health care information, etc. (basically your identity), then no need for a wallet, credit cards, health care ID, car keys, money. But it needs to work 24/7 with 99.999% reliability and some means of backup.

To realize the full potential of smartphones 4G service providers must build in DDoS resilience, authentication (DNSSEC at a minimum), and malware immunity in addition to fast response times. All of this costs money, but complicated and ineffective identity management and firewall applications are even more costly in the long run.