Is this lightweight OS safe?
Handheld PCs (H/PCs) are popular for mobile computing, and one of the most prevalent OSs for H/PCs is Windows CE. At press time, Windows CE was in release version 3.0, and it seems to be a stable platform. However, before you integrate Windows CE-based H/PCs into your network, consider the security implications of this lightweight OS.
Windows CE is essentially a stripped-down version of Windows 98. The new OS's functionality and robustness don't measure up to Windows NT's or Win98's; but this OS is fairly secure.
Microsoft designed Windows CE to extend (not replace) a Windows-based desktop's capabilities. You can connect the OS to a Windows desktop to copy files and synchronize informational sources (e.g., Microsoft Outlook folders, databases) between a desktop and a mobile device. Windows CE lets you take files from your desktop and resynchronize the files with the desktop later. Microsoft provides a variety of applications for Windows CE with Pocket Office, which contains stripped-down versions of Microsoft Word, Excel, PowerPoint, Access, and Internet Explorer (IE).
Pocket IE (PIE) supports proxy servers, Secure Sockets Layer (SSL) 2.0, SSL 3.0, and Private Communications Technology (PCT). I found that I could turn support on or off for each secure protocol individually. On the downside, PIE doesn't support security zones for controlling Web-based content, as the full-blown IE package does; however, PIE gives you limited control over cookies and caching files to disk. With cookies, PIE uses a take-it-or-leave-it approach, which means you can't configure the browser to prompt you before it accepts cookies—you must set it to either accept them or not. As for caching Web files, PIE lets you adjust only how much memory it uses to cache files and whether PIE deletes the files when you exit the Web browser. No option exists to tell PIE not to cache secured Web pages such as those you access using SSL. PIE doesn't support Java and other clientside ActiveX scripting technologies, so these technologies don't pose a security risk.
How Does Windows CE Connect?
You can connect a Windows CE device to a network with direct Ethernet connections, direct COM port connections, and dial-up connections that employ a modem. No matter how you connect your Windows CE device to a network, you'll probably need to supply a username, a password, and an NT domain name if you're authenticating against a domain controller. You don't need to provide a password for connections if your account doesn't require a password—but you must never have an account enabled without a defined
password.
Ethernet Connections
With Ethernet connections, Windows CE operates similarly to any NT or Win98 system running a Microsoft TCP/IP stack. The OS supports a variety of PC Ethernet cards and uses an associated driver to communicate on a TCP/IP network. The user must define a DHCP server or a static IP address and a subnet mask, and the appropriate DNS server addresses. The Windows CE TCP/IP stack also supports WINS servers. You use a regular Ethernet cable to connect the system to the network. After you correctly configure the device, you can use an Ethernet connection to a supporting desktop to synchronize or copy data.
Direct COM Port Connections
With direct COM port connections, Windows CE relies on supporting soft-
ware that you install on a workstation. I tested Windows CE on an NEC MobilePro 800 hand-held device running against an NT 4.0 workstation. Before I connected the hand-held device to the NT desktop, I had to load Microsoft's Mobile Devices software, which lets you connect Windows CE to the NT desktop. The Mobile Devices software relies on Microsoft's Remote Access Connection Manager to assist in the connectivity, so you must have RAS loaded on the workstation, which presents a security problem. Because you must load RAS, you must also secure RAS. I don't use RAS on my workstations, so I simply disabled the Windows CE RAS component to ensure it never answers an inbound call on my modem line.
If you use RAS for non-Windows CE purposes, be certain to adjust the settings to meet company or personal guidelines for security. For example, you can enable the RAS callback feature, set users' dial-up access permissions, define which COM ports will answer or allow outbound calls, set an encryption level, and configure any protocols your RAS installation supports.
With RAS configured, I configured the Mobile Devices application with my preferences. This configuration involved setting various communications properties, as Screen 1 shows.
In this dialog box, I could enable or disable mobile device connections, set the necessary COM port parameters for direct COM port connections, and enable or disable Ethernet-based connections. If you know you'll always connect your mobile device directly via a COM port on your local desktop, be certain that you disable the network connections so that an intruder can't hack your system over the Ethernet with a rogue Windows CE system.
Dial-up Connections
For dial-up connections, Windows CE operates almost identically to other Windows OSs. For example, to configure Windows CE to connect to my Internet dial-up account, from the Start menu, I selected Programs, Communication, Dial-up Networking. With the Dial-up Networking dialog box open, I se-
lected Make New Connection. A wizard appeared that let me choose Dial-up Connection as the connection type, and then configure the usual TCP/IP parameters (e.g., IP address, DNS servers, Point-to-Point Protocol—PPP, or Serial Line Internet Protocol—SLIP) exactly as I would when using NT or Win98. From this point, I easily connected to the Internet by clicking the newly created connection icon.
Previous
