SECURITY IN A MOBILE WORLD! ---- PART I

Security is a multilevel concept, in both the mindset and it’s practical application. The mindset refers to keeping the concepts of security at the front of your mind while you go through your daily activities. The practical application is Security itself. For now, I will only attempt to touch on the important levels (under the heading of Practical Application) that Mobile Users need to consider in today’s environments. Later I will touch on the mindset aspect of Security.

DEFINING SECURITY

These are the basic tenants of Security, which users need to make use of, or keep aware of:

1.) Physical Access: The physical access to your device or network. This is pretty much like it sounds: the ability to physically hold the device or equipment in your hand and have control over where it goes. It also refers to putting your PocketPC in your pocket when not in use, or your storing your laptop in the trunk of your vehicle. This also refers to the relative security afforded your network due to it’s physical location, usually within your building, behind locked doors.

2.) Application/Data Access: This differs from Physical Access above, in that someone can have Physical Access to your device, but not be able to gain access to the software and data on the device. This effectively describes password protection or biometric protection.

3.) Network Access: This is essentially the same as Application/Data Access above, but describes access to data or applications accessed across the network. Access to the network can be secured by use of a Authentication server. Access from the Internet can be secured by VPN. Overall network security from the outside world can be provided by use of a Firewall.

4.) Device Theft/Data Loss Mitigation: This refers to processes that come into play after the theft of your device, and deals with both the Data and the Device. Essentially, with the appropriate software package, a number of desired options can be configured to occur in a given situation. For example, if you device is not synchronized with the original HOST PC within a specified number of days (as would be the case after a device is stolen), or if a specified number of failed-logins occur, this software may be programmed to erase all of the personal data on your device to keep the data out of the wrong hands. As for hardware recovery, this type of program may also include a “phone home” capability which kicks-in when the thief later re-configures the device for Internet access, reporting as much information as can be gathered to help the original owner track down the device’s new location.

5.) Wireless Encryption: Because the Wireless Wi-Fi signal are not physically contained within the boundaries of an area you have Physical Access control over, encryption is utilized in order to make the transmission roughly equivalent to a Physically Secured wired network. This topic applies equally to the Router/Network side as well as the Device side.

There are two general types of media in which network traffic is distributed over in today’s networks. “Media” refers to the path that your packets must travel through in order to go from your device to whatever the next component is in the network (like a switch or Router). In today’s networks, the two types are either “Wired” (COAX, CAT5 or 6, Fiber, etc) and “Wireless” (Wi-Fi or Bluetooth). In terms of security, a “wired” Ethernet connection is generally expected to be more physically secure since the owner of the network is also likely to also own the property or building in which the network is placed. In other words, the owner controls the physical access to the wires, so the network media is considered physically secure.

Because your Wireless Wi-Fi connection is transmitted and received on Radio signals that you cannot directly control, additional protection schemes were devised. These schemes include WEP, TKIP, and AES, and are meant to encode the transmission (and decode the reception) of these Radio waves, such that they are supposed to be roughly equivalent to a “wired” connection in terms of physical security when Encryption is utilized. Thus was coined the original term “Wired Equivalent Protection” or “Wired Equivalent Privacy”, which most of us know as the acronym WEP.

If you do not employ some kind of Encryption, the data contents of the packet are not secured against eavesdropping. Eavesdropping is the single biggest weakness of Wireless (radio) transmissions.