Handheld Devices

The security ramifications of handheld devices are both good and bad.
The good side of these devices is that they are light, easy to carry, and
have just enough processing power to enable you to access your information
needs wirelessly from your corporate network.

Handheld devices such as Windows CE, PocketPC, and Palm-based
devices don’t usually have any file share that a hacker could compromise.
Since there is no hard drive on these devices, there is a very low
likelihood that they could accept any incoming data connections that
would compromise the integrity of your data or constitute a security
breach. These devices really have only enough memory to help you execute
the tasks you need, because most of the work is done on the remote
server to which you are connecting.

The bad elements of these types of devices are that they are too light
and too easy to steal. They are usually small enough to fit into a shirt
pocket, so it is very easy for the user to lay the device down somewhere
and expect to pick it up later. Unfortunately, since most users configure
these devices to retain all network passwords and settings in their memory,
it is a very simple matter for a hacker to use these default settings
and instantly gain wireless access to your entire corporate intranet with
a stolen handheld device.

Knowledgeable hackers understand the file system on both Microsoft
and Palm devices. There are a number of “hot sync” programs that can
literally pull the entire memory, configuration, network connections,
and passwords out of the device’s memory so that they can be used to
mount an attack against your system.

The new Palm-based devices come standard with integrated 802.11b
connectivity. As storage and memory increase on these devices, it
becomes more and more probable that secret and confidential passwords
and identity information can be accessed by hackers who come into possession
of these devices if they are stolen.

These wireless devices have the same WEP encryption capabilities as
standard wireless workstations. Setting up security involves different
menu options, depending on whether you are using a Palm or PocketPC.
It is extremely important that you activate the highest level of encryption
possible for these networked devices so that transmitted information
cannot be intercepted.