General -protection principles

Paying attention to the general protection principles below increases -security in mobile software.

Prevention -

Prevention is the key component in security threat management. -Over the past few years, the approach to security has shifted from reactive to proactive, -meaning that prevention is increasingly important. However, the reactive component -is still necessary because security levels degrade over time due to information -corruption, new attack methods and viruses, etc.

By intercepting security breaches before they even happen you can create -potentially safe applications and systems. However, even the most secure solutions -may have weaknesses, so you should never place your trust in only one method.

Control -

If a security incident is about to happen, it is still possible to minimize -and isolate damage with control of events and strong internal borders. -By dividing the system or software into sufficiently small units, it is easier -to control and manage security features. Division also helps to isolate infections -within a single unit.

Another useful control feature is the minimum rights principle, -wherein each unit is given only the minimum rights to complete its tasks. -Controls can be imposed by authenticating and authoring all -traffic between units, and by limiting access rights of unidentified parties. -These techniques can be applied from a single software component to an entire -business system.

From Symbian OS v9.1 onwards, platform security implements -control of events inside the operating system and creates borders for different -security areas (for example, by means of data -caging and server protection). Platform security also implements the -minimum rights principle.

Additionally, there are third-party -security applications such as antivirus software, firewalls, and intrusion -detection systems that provide good protection against hostile attacks -when combined with strict policies.

Testing and validation -

Even the strongest security systems may have vulnerabilities which are -not apparent until the application or product is in use. Software complexity -and combinations of different technologies are known to increase the chance -of software flaws. Software usually functions properly even when it is not -secure. This is why extensive testing and validation are needed during -development. The purpose of security testing is to find errors and flaws that -may jeopardize the security and integrity of information stored in the mobile -device.

Traditional testing validates software against specifications, but security -testing studies behavior and possible side effects in different environments. -For example, white hat hacking attempts to identify vulnerabilities -before malicious (black hat) hackers do. Common areas for security testing -include user interfaces, information storage, communications, and the software's -internal security (for example, algorithms, robustness, recovery).

To have a complete evaluation of security features and risks, it is -important to perform a full security analysis for every published version -of an application.

+ + + + + +General +protection principles +

Paying attention to the general protection principles below increases +security in mobile software.

Prevention +

Prevention is the key component in security threat management. +Over the past few years, the approach to security has shifted from reactive to proactive, +meaning that prevention is increasingly important. However, the reactive component +is still necessary because security levels degrade over time due to information +corruption, new attack methods and viruses, etc.

By intercepting security breaches before they even happen you can create +potentially safe applications and systems. However, even the most secure solutions +may have weaknesses, so you should never place your trust in only one method.

Control +

If a security incident is about to happen, it is still possible to minimize +and isolate damage with control of events and strong internal borders. +By dividing the system or software into sufficiently small units, it is easier +to control and manage security features. Division also helps to isolate infections +within a single unit.

Another useful control feature is the minimum rights principle, +wherein each unit is given only the minimum rights to complete its tasks. +Controls can be imposed by authenticating and authoring all +traffic between units, and by limiting access rights of unidentified parties. +These techniques can be applied from a single software component to an entire +business system.

From Symbian OS v9.1 onwards, platform +security implements control of events inside the operating system and +creates borders for different security areas (for example, by means of data caging and server +protection). Platform security also implements the minimum rights principle.

Additionally, there are third-party +security applications such as antivirus software, firewalls, and intrusion +detection systems that provide good protection against hostile attacks +when combined with strict policies.

Testing and validation +

Even the strongest security systems may have vulnerabilities which are +not apparent until the application or product is in use. Software complexity +and combinations of different technologies are known to increase the chance +of software flaws. Software usually functions properly even when it is not +secure. This is why extensive testing and validation are needed during +development. The purpose of security testing is to find errors and flaws that +may jeopardize the security and integrity of information stored in the mobile +device.

Traditional testing validates software against specifications, but security +testing studies behavior and possible side effects in different environments. +For example, white hat hacking attempts to identify vulnerabilities +before malicious (black hat) hackers do. Common areas for security testing +include user interfaces, information storage, communications, and the software's +internal security (for example, algorithms, robustness, recovery).

To have a complete evaluation of security features and risks, it is +important to perform a full security analysis for every published version +of an application.

\ No newline at end of file