Screening Mobile Devices to Examine Network Health

Screening mobile devices for changes to their local registries is a key vital sign that can provide comprehensive health examinations for the benefit of an enterprise network. Our research reveals that the registry can be modified with very little difficulty to include "protected" entries within the WinCE registry. Our testing demonstrated that in many commercial computing systems the default configuration permits all access in order to facilitate ease of use, thus exposing this perilous vulnerability. Critical changes to the registry from attacks or direct manipulation are detected by our work, providing increased protection and response time. Vital signs taken from the registry, along with other device data, is periodically reported back to a monitor using a registry short-list, delta-set update via agents we designed for effective reporting (ER) for further diagnosis of the health threat these changes pose to the mobile device(s) and, in the aggregate, the network.