5/14/2007 -- Believe it or not, enterprise users aren't all that knowledgeable about the ins and outs of wireless security.

That's the mostly tongue-in-cheek upshot of new research from market watcher In-Stat, which reports that enterprise wireless consumers are typically most concerned about security issues that are so last year: In most cases, In-Stat reports, user awareness lags behind technology maturation and the wireless technology replacement cycle.

"Based upon the results of our end user survey, a majority of users overestimates the risk, misunderstands the security threats that do exist and looks for protection from sources that cannot help," said In-Stat analyst Bill Hughes in a statement.

If In-Stat's survey is any indication, enterprise users are seriously behind the curve. "A majority are concerned about Electronic Serial Number...theft through the 'cloning' of their phone's information and the ability of stalkers to track their location. But carriers addressed these situations as far back as a decade ago," Hughes pointed out.

As a result, In-Stat not surprisingly concluded that companies must assume liability for the wireless devices that access internal systems. But the biggest potential problem isn't what you might think -- namely, the technological aspects of wireless security. Instead, the researcher stressed, human behavior (or, more to the point, practical behavioral patterns) pose the biggest overall challenge to wireless security. Wireless enables new and hitherto undreamt-of usage patterns, the researcher pointed out, and in turn creates unanticipated opportunities for inadvertent information disclosure.

In-Stat chronicles a raft of potential disclosure scenarios, most of which involve carelessness or simple lack of oversight on the part of end users. The greatest threats involve either the loss of equipment (especially wireless phones) or carelessness with respect to passwords or default wireless settings.

For example, In-Stat noted, smart phone users tend to lose their devices 40 percent more frequently than mobile phone users. Elsewhere, the researcher said, a surprising percentage of organizations let their users decide what technology to use for mobile data -- regardless of the attendant security implications.

One potential fix for this, In-Stat concluded, is for carriers to further differentiate their offerings by offering security training to their customers. --Stephen Swoyer