Windows Phone 7 ‘not fit for big biz … unlike Android, iOS’
B-Sides Window Phone 7 is not yet fit for enterprise deployments, according to an application security expert.
David Rook, application security lead at Realex Payments, told delegates at the B-Sides conference in London that the youngest of the smartphone operating systems is less mature than either Google’s Android or Apple’s iOS. Rook’s well-received presentation focused on how developers can produce apps for consumers that are free from common application security vulnerabilities.
The most important issues to focus on are privacy, authentication and authorisation and secure storage. Rook said other issues in application security such as input validation ought not to be neglected but are less important in practice than the three top areas he outlined.
“We need input validation but most problems in practice are caused by top three risk areas,” Rook explained.
The current Windows Phone 7 framework doesn’t allow app to access data held by other apps. Microsoft is likely to reverse this, according to Rook.
Examples of possible problem areas include flaws in mobile ad libraries and the like from third-party suppliers.
Window Phone 7 is based on the .Net developer framework and many of the same security principles apply. “There are no new issues in app security here that we don’t now how to review and test,” Rook explained.
The smartphone OS has various in-built security features but “like any security system it’s only a matter of time before these get broken,” Rook warned.
Rook has developed a utility called Windows Phone App Analyser to assist software creators in uncovering possible problems. ®
Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/04/30/window_mobile_7_security/