New NIST Security Guidelines for Cell Phones and PDA Devices

Are more and more of your workers becoming mobile and accessing the Internet via portable devices? Well security help has arrived. The National Institute of Standards (NIST) has released an excellent new publication entitled:“Guidelines on Cell Phone and PDA Security (Draft).”

This new guide (Special Publication 800-124) offers an excelent overview for all organizations, regardless of whether you are in government or not. Here’s an excerpt:

_“Because of their small size and use outside the office, handheld devices can be easier to misplace or to have stolen than a laptop or notebook computer. If they do fall into the wrong hands, gaining access to the information they store or are able to access remotely can be relatively easy.

Communications networks, desktop synchronization, and tainted storage media can be used to deliver malware to handheld devices. Once established, malware can initiate a wide range of attacks and can spread itself onto other devices. As with desktop computers, cell phones and PDAs are subject to spam.

Besides the inconvenience of deleting them, charges may apply for inbound activity. Spam can also be used for phishing attempts.

Electronic eavesdropping on phone calls, messages, and other wirelessly transmitted information is possible through various techniques. Installing spy software on a device to collect and forward information elsewhere is the perhaps the most direct means, but other components of a communications network, including the airwaves, are possible avenues for exploitation.

Location tracking services allow the whereabouts of registered cell phones to be known and monitored. While it can be done openly for legitimate purposes, it may also take place surreptitiously.

It is possible to create a clone of certain phones that can masquerade as the original. Once popular with analog phones, it is not as prevalent today with the rise of digital networks, but some early generation digital equipment has been shown to be vulnerable.

 Server-resident content, such as electronic mail maintained for a user by a network carrier as a convenience, may expose sensitive information through vulnerabilities that exist at the server. ”

While these devices provide productivity benefits, they also pose new risks to an organization’s security.