Securing consumer-friendly smart phones

(continued from previous page)

That said, security technologies can be used mitigate risk. For example, T-Mobile, which operates more than 7,000 Wi-Fi hotspots throughout the U.S., uses Wireless Protected Access with 802.1x security technology. The WPA technology is designed to make it more difficult for unauthorized people to view data while it is being wirelessly transmitted within a T-Mobile hotspot, a T-Mobile representative said.

But logging in to insecure Wi-Fi networks can be dangerous, because infected devices can wreak havoc, once they return to the carrier or corporate networks.

"Users are most exposed to security vulnerabilities where the carrier isn't providing the service, such as open Wi-Fi networks or Bluetooth connections," said Mike Hendrick, director of product development at T-Mobile. "But there are security measures that can be used to minimize these risks, and we encourage our users to turn on security features whenever possible."

Preemptive preparation
Security companies have already started preparing for the onslaught of mobile threats. For example, security company Symantec has embedded its antivirus software in some Nokia devices, such as the nSeries multimedia phones. It's also preinstalled on Dell PDAs.

Another security provider, F-Secure, has been working with carriers in Europe to offer its software as part of a managed service. Vodafone and Orange are two wireless operators using F-Secure's software to offer antivirus protection to subscribers. The company also is in talks with U.S. operators to offer similar services.

F-Secure's antivirus software can also be purchased by individual consumers on its Web site for $34.95 for a one-year license. Symantec also offers antivirus software that can be downloaded from its Web site. It's now available for a 30-day trial on Symbian phones, to which it can be delivered wirelessly and paid for using premium SMS and a credit card. The next Windows release will support the trial and over-the-air payment options.

"Smart phones are more computers than phones these days," said Paul Miller, managing director for mobile security at Symantec. "If users protect their PCs they (like the enterprise) also need to protect the computer on their hip."

While viruses and other malicious software will likely become a threat on mobile devices in the future, experts say there are other security issues that are more pressing today.

"By far the biggest problem for most people is losing a phone or mobile device in the back of a taxicab, or having a device stolen," said Nate Dyer, an analyst at the Yankee Group.

Lost phone, lost data
Smart phones can store a slew of sensitive information, from phone numbers to e-mails to passwords to bank account data. Large companies, especially, see this as a threat. In fact, losing sensitive corporate data has been identified by enterprise IT managers as the No. 1 security risk their mobile work force faces, according to Yankee Group research.

Companies such as Research In Motion and Microsoft, which has developed a mobile operating system running on such devices as HTC's Dash, have products with built-in security features that allow IT managers to remotely delete information from devices if they're lost or stolen. The providers have also instituted secure password controls that require users to enter passwords to log in to mobile devices when they're turned on or when they have been inactive for a certain period.

"Customers want to be assured that the device they are using is protected from unauthorized use," said Alan Panezic, vice president of product management at RIM. "We've been offering many of these features for at least four years. And we also offer the ability to customize the features for customers, especially those in the military or government."

Being able to remotely wipe a device clean is a great feature, but RIM's and Microsoft's solution requires an IT administrator to initiate the commands. Microsoft said that starting early next year, it will allow individuals to remotely delete information on smart phones running its software if they are linked to servers running the next release of Microsoft Exchange software.

U.K.-based Synchronica offers remote memory-deleting software that mobile operators can use to offer security services directly to consumers. Remote XT, a new cell phone data backup and security service in London, is using Synchronica's technology and offering the service to consumers. The Synchronica software also offers secure password protection, and it actually makes cell phones scream if someone tries to crack the password.

"Microsoft and BlackBerry are only addressing part of the enterprise market," said Carsten Brinkschult, CEO of Synchronica. "Our software can also be used for individuals with smart phones. Effectively, we serve 100 percent of the market."

While several security solutions exist today, it can be difficult to put them into practice, because handsets are not built to the same specifications. But that is changing.

The Trusted Computing Group's Mobile Phone Work Group last month released a draft of security specifications that will serve as a blueprint for device makers, mobile software developers and service providers. This should make it easier for security companies to build solutions that will work on a wide array of devices. TCG has already developed similar security specifications for PCs and servers.