83 Safari Patches: Could Rise of Apple Affect Enterprise Security?
By Jennifer LeClaire / Top Tech News. Updated March 13, 2012.
The "bring your own device" movement is gaining major momentum. That's why Apple's latest round of patches may concern enterprise IT admins.
Apple on Monday updated Safari to version 5.1.4 as it patched a whopping 83 vulnerabilities. It's a record for Safari 5, and the fact that 72 of the flaws were rated critical didn't help ease the concern. The saving grace: None of the vulnerabilities has been exploited in attacks. But mobile industry watchers are still concerned about the ripple effect.
"The consumerization of enterprise mobility -- most visibly manifested by the BYOD trend -- has now moved on to the application front," said Philippe Winthrop, mobility analyst and founder of the Enterprise Mobility Forum. "Organizations are now quickly recognizing the power and value of providing mobile applications to both their employees and their customers. Despite this, many companies are still faced with the challenge of striking the balance between maintaining security and control for IT, while preserving the user-experience of the device for the employee."
Was Apple Pwned?
"Since Safari and Chrome both use WebKit, the open-source browser engine, it allows Apple to reap the benefits of Google's web bounty program, which is responsible for the majority of the Safari WebKit-related fixes," said Marcus Carey, security researcher at Rapid7. "The timing of these patches also comes on the heels of CanSecWest Pwn2Own and Google's Pwnium competitions, where researchers try to research and exploit browser bugs."
Whenever there are new products announced from Apple, people should always expect tons of updates containing security fixes, product enhancements, and of course Apple's ever-changing EULA, Carey said. Shortly after he saw the new iPad announcement, he started noticing prompts for updating software and agreeing to new terms on his Apple products.
"There are a couple of takeaways from this -- the first being that Apple products are 'hacker proof' is a myth. With the bring-your-own-device movement gaining steam in IT enterprises, there are many organizations that have Apple products appearing in their networks without the tools to manage them," Carey said. "Even just allowing employees to install iTunes on their machines exposes the organization to Safari/WebKit vulnerabilities."
According to Forrester Research, 60 percent of U.S. companies have already established bring-your-own-device programs. The knee-jerk reaction among employers is to lock down end-point devices by adding additional security software, restricting functionality, and requiring long and complicated passwords to access the device.
Users, however, don't want to have to enter a password just to access Facebook, be restricted to which apps they can download, or limited in which functions they can use. Smartphone adoption -- the impetus behind BYOD -- has been driven by the user experience, a fact that is forcing companies to look for a new balance between usability and security.
"IT managers are saddled with the task of figuring out how to manage proprietary corporate content without sacrificing security and the end-users' experience with their mobile devices," said Naeem Zafar, CEO and president of Bitzer Mobile. "Device management solutions miss the point. It's not about managing a device; it's about securing the flow of the data."