The Security Gap in Wireless Mobility (Handsets)

by C. Enrique Ortiz, February 19, 2005

The wireless security gap used to be about the "WAP gap"; the security gap between a WAP client (handset) and a Web host, where data integrity and confidentiality became compromised at the WAP gateway due to the transition between WTLS and TLS. Today WAP 2.0 has addressed this gap by using TLS end-to-end, from the handset to the Web host.

But the wireless mobility security gap still exist today; secure mobile access to sensitive resources and information are still compromised. The gap is complex and consists of the following related items:

  1. Mobile access occurs over unsecured channels.
  2. Lack of non-repudiated device identity.
  3. Lack of access control.
  4. Lack of policy management.
  5. Lack of digital user identity & management.
  6. Lack of local data protection/confidentiality.
  7. I also like to include "lack of application and licensing management", because access to sensitive resources and information should be controlled, possibly through authorized and properly licensed applications.

Some of the above items are obvious while others require more explanation; at a later point I will publish more about this gap; in the meantime this is food for thought for the reader, to whom I will leave the exercise of understanding each of the items above, and why it is important to address them, and address them together. Note that the gap exists not because there is a lack of technologies to address it, but due to the lack of standardization across devices (with respect to the above items), lack of understanding the gap and how to address it, and lack of solutions that allow corporate IT and even network carriers to manage the above items: the result is lack of security enforcement.

Standardization is so important to close this gap; and standardization comes in different levels... for example, at the functional level, or at the functional + API level; I would be happy if it existed at least at the functional level (but of course a single API across handsets is very important as well). Talking about standardization, from the J2ME perspective, I am hoping that the JSR-232 expert group is working on the management items mentioned above: non-repudiated device identity, and application, policy and public key certificate (user identity) management.

ceo

 

 

Why Google Ads?
To help subsidy this web site's hosting expenses.