Chapter 3: Wireless Internet Security

Dennis Seymour Lee

3.1 Introduction

Recalling the early days of the Internet, one can recount several reasons why the Internet came about:

• A vast communications medium to share electronic information

• A multiple-path network that could survive localized outages

• A means for computers from different manufacturers and different networks to talk to one another

Commerce and security at that time were not high on the agenda (with the exception of preserving network availability). The thought of commercializing the Internet in the early days was almost unheard of. In fact, it was considered improper etiquette to use the Internet to sell products and services. Commercial activity and its security needs are more-recent developments on the Internet, having come about strongly in the past few years.

Today, in contrast, the wireless Internet is being designed from the very beginning with commerce as its main driving force. Nations and organizations around the globe are spending millions, even billions of dollars to buy infrastructure, transmission frequencies, technology, and applications in the hopes of drawing business. In some ways, this has become the "land rush" of the new millennium. It stands to reason, then, that security must play a critical role early on as well: where money changes hands, security will need to accompany this activity.

Although the wireless industry is still in its infancy, the devices, infrastructure, and applications development for the wireless Internet are rapidly growing on a worldwide scale. Those with foresight will know that security must fit into these designs early. The aim of this chapter is to highlight some of the significant security issues in this emerging industry that need addressing. These are concerns that any business wishing to deploy a wireless Internet service or application will need to consider to protect itself and its customers, and to safeguard investments in this new frontier.

Incidentally, the focus of this chapter is not about accessing the Internet using laptops and wireless modems; that technology, which has been around for many years, in many cases is an extension of traditional wired Internet access. Neither will this chapter focus on wireless LANs and Bluetooth, which are not necessarily Internet based, but deserve chapters on their own. Rather, the concentration is on portable Internet devices, such as cell phones and PDAs (personal digital assistants), which inherently have far less computing resources than regular PCs. Therefore, these devices require different programming languages, protocols, encryption methods, and security perspectives to cope with the technology. It is important to note, however, that despite their smaller sizes and limitations, these devices have a significant impact on information security, mainly because of the electronic commerce and intranet-related applications that are being designed for them.