Planning +system and software security

Devices based on the Symbian platform are capable of joining both public +and private networks and often have the functionality of a normal desktop +computer. However, the average user does not perceive the device as a computer, +but rather as a regular phone that is safe from security threats. This creates +an opportunity for hostile attackers to infiltrate the device and wreak severe +direct or indirect damage (for example, by penetrating into the corporate +intranet).

It is, however, possible to anticipate these kinds of threats, and protect +applications by using the security features offered by the Symbian platform, +and by expanding security policies to cover mobile devices and services.

The security development process is guided by cost, efficiency, and usability. +If security is too tight, this may be expensive and affect both performance +and the user's experience of the system or software. On the other hand, if +security is too slack, this may result in severe damage and, in the long run, +be even more costly.

Security methods +

The list below contains the most common and important security methods +used in the mobile world:

Ciphering enables confidentiality. Information is +accessible only by authorized parties. With ciphering it is also possible +to maintain integrity.
Hash function (checksum) can be used to verify +integrity and detect information tampering.
Signing allows attaching of information to a certain +source.
Authentication ensures that the object is what it +claims to be.
Access control restricts unauthorized access to resources.
+
Authorization is permission to perform tasks on behalf +of somebody else.
Certification is provided usually by a third party +to prove information validity.
Recovery mechanisms are usually implemented as redundancy +(duplication of information or routes).
In communication it is possible to use, for example, error +correction to repair transmission failures, random traffic generation to +keep the line occupied, and packet uniforming to blend important packets +into traffic.

Some of the methods above are interconnected (for example, certification +requires that the information is signed) and not all of them are of equal +importance, since some basic methods form a base for more complicated methods.