From the land of more stuff to bog down your already slow converged mobile device (and your relatively speedy non-converged device) comes the latest security offering from Symantec – Mobile Anti-Virus 4.0 for WM. Now, anybody who knows me knows I am a big fan of really anything that will help lend it’s hand to increasing security in the network infrastructure … heck I spent 3 years studying security in college – but with that said I still wonder where these product offerings fit into the spectrum. Realistically the threat to mobile devices is there, but right now it’s sort of like M. Night Shyamalan’s The Village – We all know the threat is there, and we all know if we go walking into the woods there’s a pretty good chance that we’re going to end up dead as a doornail. — Much more after the break.

So, where does that leave us? Well it leaves us at a point where the security staff needs to evaluate the usage of mobile devices within the infrastructure and determine the level of vulnerability versus the cost of investing hard earned capital into mobile device security. Let’s take a quick look at why (IMHO) spending a ton of cash on Mobile AntiVirus software for the small to medium sized business right now is nothing more than throwing money out the door – and there’s better (and more effective ways) to mitigate the risk while providing more benefit.

 Arguably the first real Windows Mobile virus appeared on the scene in July of 1994. This "virus" was not widely distributed and was sent directly to AV vendors. It is not and was not "in the wild". Since this time, how many advisories for Windows Mobile can be found? ZERO. Yes – Zero. Now there was a "virus" released in the wild a short while ago, but this one did no damage and required a PC in order to do anything … google search for "Crossover" worm for more detail on this one. All-in-all there’s barely a hand full of "threats" out there for Windows Mobile, and none of them (that I’m aware of as of this writing) can be considered a viable threat to the Windows powered mobile device. (Symbian users – If there’s a bigger threat to those devices please let us know as I’m not a Symbian user and don’t really follow the OS that closely.)

So, with all that said -  Will Mobile devices NEED AntiVirus in the future? Without a doubt. Do they need it now? Not unless your information systems policies require it. How can you mitigate the risks and provide more functionality for a similar cost per unit? Simple:

1. Chances are good that the company is providing mobile email to the device if you’re running converged hardware. In this case a good front end anti-virus solution for the mail gateway and backend servers should already be in place. If it’s not, the mobile devices in your infrastructure are the least of your concerns. So – if it isn’t going to get to the end users desktop, does it pose a good chance of getting to the mobile device? Nope.

2. Assuming you are running Exchange 2k3 – Configure the Messaging and Security Feature Pack for Windows Mobile 5.0. Give your admins the ability to remotely wipe a device that gets "misplaced". Heck give your users the ability to call the IT department up and say – "This person just walked up and stole my phone right out of my hands" and know with all certainty that the data is not at risk.

 3. Encryption. Keep the corporate information secure ON THE DEVICE. Make it impossible to get anything important of the device without knowing the right passwords: For simple "wallet" encryption check out my favorites – FlexWallet or eWallet (there’s others so check them out too) or for more enterprise encryption be cure to look into Credant Mobile Gaurdian. There’s a great review HERE. Credant can do a lot more so be sure to check them out.

4. Backup. Backup your device. Spb Backup, SK, Sprite and others provide great products. A virus is useless against a good backup plan… and that’s what makes mobile devices so resiliant. Until someone can figure out how to infect the built-in ROM – I’m a hard reset away from being back online and virus free.

Now, obviously this short "rant" was not designed to replace your existing security policy for mobile devices (you do have one right?), but it should help guide you down the right path to mobile device security… and mitigating the risks posed by threats to your workers while still providing some ROI for your software purchases.

[tags]Mobile device security, antivirus for Windows Mobile[/tags]