14 November 2007

iPhone unfit for corporate email

SA Mathieson

Experts believe that Apple’s iPhone, released in the UK and Germany on 9 November, is not secure enough to access corporate email systems – a sentiment endorsed by O2, the sole British mobile telephone network providing the device.

“The iPhone does still does not meet enterprise security policy requirements,” wrote Gartner analysts Ken Dulaney and John Girard, in a research note published on 12 November, in response to Sybase’s October 23 announcement that it would support the iPhone within its Information Anywhere suite. “End users supporting it may be lowering security standards.”

“Apple has not yet delivered changes to the iPhone that would alter Gartner’s assessment of its security weaknesses,” Dulaney and Girard continued, adding that corporate wireless email systems will not be able to secure the device itself, through measures such as encrypting locally-held data, forcing password changes and wiping devices remotely. “Enterprises that add support for the iPhone on otherwise enterprise-class wireless email systems will compromise their overall end-point security.”

A spokesperson for O2 said: “We tend to agree with what was said. The iPhone from O2 is a consumer proposition with consumer tariffs.” The firm has claimed sales of tens of thousands of the devices over its first weekend on sale, at a price of £269 plus an 18-month, £35 a month, contract.

“We would probably recommend to our customers looking for a corporate email solution either BlackBerry or Good Technology from Motorola,” the spokesperson said, although adding that Apple itself uses iPhones for corporate email.

Members of Infosecurity’s editorial board, in a recent discussion on current and future threats, said problems caused by the iPhone could exceed those caused by the BlackBerry. “You bet there's going to be some bleeding-edge executives who say right, I want to have an iPhone now, my BlackBerry's not sexy enough anymore, make sure that I can receive everything on that device,” said Hugh Penri-Williams, an independent consultant and former chief information security officer of French group Alcatel.

Richard Ford, associate professor and director of the Centre for Security Sciences at the Florida Institute of Technology, said: “The iPhone is the ultimate fashion accessory on this side of the Pond right now, and you're going to see exactly the same thing happen, squared probably, in Europe.”

“It's simply dumb security risks, like you losing it with all your credentials on it, which is something we don't talk about because it's not very sexy,” Ford added, of the risks the iPhone poses. “But I spend as much time worrying about that as somebody hacking the thing.”

The editorial board’s discussion will appear in the November/December issue of Infosecurity magazine, and on this web-site.

Warning as first serious Apple Mac Trojan hits (6 November 2007)

2007 preview: What's rollin' round the bend? (November/December 2006 issue)

News index