Top Security Worries: Laptops, Mobiles And VoIP

The SANS Institute has come out with their list of the top things that businesses should be worried about in the security space heading into 2007, with data security on laptops leading the way. This is followed by worries about data security on both mobile phones and VoIP systems. It’s an interesting list, mainly because of the difference between laptop security — which has been an issue for many years, and mobile and VoIP security, which are new issues. Laptop security received plenty of attention in the last year, driven mainly by story after story after story of laptops being lost. By this point, there are probably very few people in charge of security who aren’t at least aware of the issues to be careful about concerning laptop security.

At the same time, both mobile and VoIP security are topics that have received press attention, but few reports of serious attacks so far. That makes it a bit trickier, since some worry about overstating a threat not yet realized. However, the trends in both areas suggest that it’s reasonable to get prepared now, rather than after the major attacks come. As mobile phones increasingly turn into portable computers in our pockets, they contain more and more important data. Since many of these devices include multiple ways of connecting (cellular connectivity, Wi-Fi, Bluetooth or even by USB cable), there are bound to be increased attacks from a variety of different directions. On top of that, there’s the simplest attack of all: losing a mobile phone. You never know who might end up with it. So, while there haven’t been any big outbreaks on mobile phones, that doesn’t mean it’s not an area where companies need to pay attention. They don’t need to go overboard, but they need to be aware of the potential for problems.

When it comes to VoIP, again, there’s been a lot more smoke than fire up until now. But as SANS reports, VoIP is increasingly making its way into the enterprise, rather than as just a home solution. This is another area where it’s not entirely clear what form attacks may take, but the opportunity to shut down a company’s phone system may be a compelling target for certain hackers.

Understanding and preparing for potential threats can be just as important as protecting against currently known threats. While making sure not to get carried away by every possible threat is important, it’s equally important to be aware of the obvious trends in security risks.