Feeds

Windows Phone 7 'not fit for big biz ... unlike Android, iOS'

Enterprise sec expert bigs up Microsoft rivals

Internet Security Threat Report 2014

B-Sides Window Phone 7 is not yet fit for enterprise deployments, according to an application security expert.

David Rook, application security lead at Realex Payments, told delegates at the B-Sides conference in London that the youngest of the smartphone operating systems is less mature than either Google's Android or Apple's iOS.

Rook's well-received presentation also discussed how developers can produce apps for consumers that are free from common application security vulnerabilities.

However, for enterprise deployment, the most important issues to focus on are authentication, authorisation and secure storage, he said.

Speaking to The Reg after the event, Rook explained: "The main three things that would stop me personally deploying WP7 in the enterprise would be the lack of native disk encryption, no support for client side SSL certificates and the lack of in built VPN functionality.

"In addition to those features being missing Microsoft have specifically targeted the consumer market with WP7 which to me says a lot about it being the right solution for the enterprise. I believe WP8 will include native bitlock disk encryption but this isn't in WP7."

He added that he would personally prefer iOS devices in enterprise scenarios, but said "Android can be securely deployed, of course, as a friend of mine pointed out recently".

Rook told delegates at B-Sides that other issues in application security such as input validation ought not to be neglected but are less important in practice than the three top areas he outlined.

"We need input validation but most problems in practice are caused by top three risk areas," Rook explained.

The current Windows Phone 7 framework doesn't allow app to access data held by other apps. Microsoft is likely to reverse this, according to Rook. Examples of possible problem areas include flaws in mobile ad libraries and the like from third-party suppliers.

Window Phone 7 is based on the .Net developer framework and many of the same security principles apply. "There are no new issues in app security here that we don't now how to review and test," Rook explained.

The smartphone OS has various in-built security features but "like any security system it's only a matter of time before these get broken," Rook warned.

Rook has developed a utility called Windows Phone App Analyser to assist software creators in uncovering possible problems. ®

Bootnote

The article was updated to include comment from David Rook after the B-Sides conference.

Beginner's guide to SSL certificates

More from The Register

next story
Bono apologises for iTunes album dump
Megalomania, generosity and FEAR of irrelevance drove group to Apple deal
HBO shocks US pay TV world: We're down with OTT. Netflix says, 'Gee'
This affects every broadcaster, every cable guy
Facebook, Apple: LADIES! Why not FREEZE your EGGS? It's on the company!
No biological clockwatching when you work in Silicon Valley
French 'terror law' declares WAR on the INTERNET itself, say digi-rights folks
Liberté, Égalité, Fraternité: Two out of three ain't bad
SCREW YOU, EU: BBC rolls out Right To Remember as Google deletes links
Not even Google can withstand the power of Auntie
Arab States make play for greater government control of the internet
Nerds told to get lost in last-minute power grab bid at UN meeting
Zippy one-liners, broken promises: Doctor Who on the Orient Express
Series finally hits stride, but Clara's U-turn is baffling
Don't bother telling people if you lose their data, say Euro bods
You read that right – with the proviso that it's encrypted
America's super-secret X-37B plane returns to Earth after nearly TWO YEARS aloft
674 days in space for US Air Force's mystery orbital vehicle
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.