From desktop to mobile: Examining the security experience

Abstract

The use of mobile devices is becoming more commonplace, with data regularly able to make the transition from desktop systems to pocket and handheld devices such as smartphones and PDAs. However, although these devices may consequently contain or manipulate the same data, their security capabilities are not as mature as those offered in fully-fledged desktop operating systems. This paper explores the availability of security mechanisms from the perspective of a user who is security-aware in the desktop environment and wishes to consider utilising similar protection in a mobile context. Key issues of concern are whether analogous functionality can be found, and if so, whether it is offered in a manner that parallels the desktop experience (i.e. to ensure understanding and usability). The discussion is supported by an examination of the Windows XP and Windows Mobile environments, with specific consideration given to the facilities available for user authentication, secure connectivity, and content protection on the devices. It is concluded that although security aspects receive some attention, the provided means generally suffer from usability issues or limitations that would prevent a user from achieving the same level of protection that they might enjoy in the desktop environment.

Introduction

An increasing amount of information is being stored on mobile devices. Indeed, it has been suggested that, in business scenarios, over 80% of new and critical data is now stored in this context (Allen, 2005). In 2005, Gartner predicted that smartphones would be favoured as thin clients for mobile workers (Jones, 2005), and the subsequent quarter-on-quarter growth in smartphone shipments, of 49.8% in Q2 2006 (Cozza et al., 2006) and 44% in Q2 2007 (Cozza et al., 2007), is certainly indicative of their increasing popularity.

Although a broad definition of mobile devices would include laptop computers, the focus of this paper is specifically geared towards pocket and handheld devices such as cellular phones and Personal Digital Assistants (PDAs), with the convergence of these devices into so-called smartphones also being relevant. While not as powerful as desktop or laptop systems, these devices now support a fairly rich set of functionality, with a variety of personal information management features (e.g. contacts, scheduling, etc.), cut-down versions of applications such as word processors and spreadsheets, and Internet connectivity via email, web browsing, and instant messaging. Even at a baseline, the data held on such devices could include contact details of clients and suppliers, or calendar items revealing sensitive business dealings. As such, they can clearly be an asset worthy of protection.

Unfortunately, in addition to their capabilities, mobile devices are by their very nature more vulnerable to threats such as theft and accidental loss than larger systems in fixed locations. For example, back in 2001, the UK Home Office highlighted the desirability of mobile phones as targets for theft, reporting that over 700,000 handsets had been stolen (Harrington and Mayhew, 2001). Meanwhile, other unofficial reports (Leyden, 2002) put this figure in the region of 1.3 million. In addition, pocket devices are extremely susceptible to loss; a problem that is clearly indicated by the following advice quoted from the London Taxi lost Property site (our emphasis added):

“For mobile phones, it is essential that you supply details of the phone make and model, mobile phone service, and either the IMEI number of the phone or your SIM card number. Due to the quantity of mobile phones received, individual mobile phones cannot be identified without this information.” (London Taxi, 2007)

From a security perspective, the significant consideration here is that these devices may contain possible sensitive or valuable information (Chapman, 2007). Of course the risk can be downplayed by arguing that many of these thefts are committed in order to obtain the devices rather than their data. While this may potentially be true for now, the increasing role of the devices as repositories of sensitive information means that opportunities for data exploitation may not be overlooked for long.

In view of these threats, it is reasonable to suggest that security is an increasingly important consideration. Moreover, the fact that mobile devices now store and access comparable data and services to desktop systems implies that similar security provisions ought to be available. Indeed, some users will already utilise security on their desktop, and will be keen to parallel this on their mobile devices. Unfortunately, however, the reality of their experience may currently be quite different, with obstacles posed by mechanisms that are presenting in a different way, or indeed by functionality that is absent entirely. This raises fundamental problems. If the security features are not available, then data will be receiving less protection in a fundamentally more vulnerable location. If the features exist, but are not presented in a comparable manner, then it may mean that users cannot easily transfer their security skills from the desktop.

This paper examines the differences in security mechanisms between desktops and mobile devices that users may encounter when attempting to perform the same core tasks. This is explored from three perspectives: identification and authentication, network connectivity, and content security. Key aspects of each are examined from the perspective of a desktop user looking for the related features in a mobile context. The evaluation enables conclusions to be drawn regarding the security features that exist, and the consequent similarity of the end-user experience between current desktop and mobile systems.