All of these conduits are potential paths and openings for viruses, Trojans, and password sniffers. By following your corporate security policies, not only will end-users help protect your expensive corporate infrastructure, they will also help protect their expensive mobile device.

Whether handhelds are purchased by end-users out of their own pocket, or by your corporation or federal agency, you need to ensure that the end-users abide by rules and regulations to keep your enterprise networks safe.

If you are a federal agency and are striving to get good scores on your FISMA Cyber Security Report Card, you'll need end-user Rules of Behavior that include handhelds.

Policies for End-Users
Your organization's end-user policies—often referred to as Rules of Behavior—will vary according to your unique infrastructure and requirements. You need to obtain acknowledgement from your end-users that they will agree to abide by these policies.

Acknowledgement can be obtained either online through some automated mechanism, a simple e-mail, or a signed piece of paper.

These are the types of behaviors you want your end-users to agree to, and they are written as though they were written for end-users to read:

Remind your users is that though these steps may appear restrictive, taking these precautions will help ensure that their expensive handheld device does not get sabotaged by viruses, Trojans, and unauthorized users.

Policies for Administrators
Administrators need to ensure that operational provisions for handheld users are put in place, so your business needs should require that end-users and administrators are held accountable for doing the right thing.

Not only that, policies set standards.

So administrators should not have to wonder what rules they are supposed to follow when setting up an account. Having policies for systems administrators also ensures that all of the accounts are being set up the same way.

The policies should be clearly spelled out so that the administrators understand exactly what it is that they are supposed to do. To be sure, you should include the systems and security administrator in helping you define both the end-user policies and administrator policies.

Administrators should advise end-users on how to configure their handheld firewall. HotSync uses TCP and UDP ports and ActiveSync uses TCP ports to synchronize.

End-users need to know whether these ports can be enabled or not. When TCP and UDP ports are open hackers may attempt to connect to these ports during this time.

While policies will vary from organization to organization depending on your infrastructure and requirements, below are some examples of sample policies for handhelds that would be appropriate for system administrators:

Hopefully reviewing these fictitious policies will help you understand the types of security policies that are needed on enterprise networks.

Administrators should become familiar with which ports ActiveSync (Windows Mobile) and HotSync (Palm) use so that handheld firewalls can be properly configured. Table 1. indicates which TCP and UDP ports ActiveSync and HotSync use.

                                      Table 1. TCP and UDP Ports Used by ActiveSync and HotSync

	TCP Ports Used	UDP Ports Used
ActiveSync	990, 999, 5678, 5679	---
HotSync	14237, 14238	14,237

The Upshot
The more powerful and more versatile mobile device become, the more your users will want to use them. Viruses and worms for these devices, however, are proliferating at increased rates.

So like desktop computers, handhelds are susceptible to port scanning, denial of service attacks, session hi-jacking, spoofing, theft of information, and theft of the device itself. In addition, many end-users store passwords, credit card information, and sensitive company information in personal databases on their PDAs, smartphones, and cell phones.

As a result, when you allow workers to connect their handhelds to the corporate network you are putting the enterprise at risk. That's why precautions are so important.

Ensuring that both end-users and administrators use specified security policies is one way to mitigate risks. The security policies should be reviewed on an annual basis and refined and updated as needed. And the company security officer should be held accountable for ensuring that the security policies are enforced.