"Eventually, this information is going to have to remain on servers and simply be accessed seamlessly from mobile devices. The solutions still need to mature a bit to make this happen.???
"Techniques would be to keep data centralized so it can be viewed and altered but not carried away on a device."
This is... fantasy. There is no amount of "maturity" that will prevent a determined attacker from exploiting mobile devices just because the user is "viewing" the information rather than "storing" it. Because in reality, if you can "view" the documents on a mobile device, that document IS stored on the device for some period of time (whether it is on "disk," in memory, or on the screen, or all three,) and because of that an attacker can compromise them by compromising the device. It doesn't even matter if the document management system is sending an "image" of the document for you to read, if it shows up on your device, it can be compromised. No amount of wishful thinking will change that--short of human beings being genetically modified to include DRM in our eyeballs so that "unauthorized" data can't be read by human beings, within the boundaries of contemporary computer science, this is essentially an unsolvable problem.
It doesn't matter if they're "stored" in the traditional sense (i.e. "the permanent copy") "on the server," and you only get a "view" of it on your device--if you can see it on a device, a determined attacker can steal it. Even if I'm looking at an "image" of a document (i.e. not a downloaded, local copy) it doesn't matter--OCR exists, and all an attacker would have to do to compromise this data "viewing" scheme would be to send a screen capture somewhere and analyze said caps with OCR at the attacker's convenience.
And any scheme you can invent remains vulnerable to this attack, regardless of how it works. If, at some point, it is on the screen, it is vulnerable. Even if that info isn't "stored locally" on a disk, if its in RAM it is vulnerable. When you factor in that these devices are "unmanaged" in most environments it makes it almost certain that some percentage of these devices will be compromised.
Discussion on:
Message 1 of 14

































