Paying attention to the general protection principles below increases security in mobile software.
Prevention is the key component in security threat management. Over the past few years, the approach to security has shifted from reactive to proactive, meaning that prevention is increasingly important. However, the reactive component is still necessary because security levels degrade over time due to information corruption, new attack methods and viruses, etc.
By intercepting security breaches before they even happen you can create potentially safe applications and systems. However, even the most secure solutions may have weaknesses, so you should never place your trust in only one method.
If a security incident is about to happen, it is still possible to minimize and isolate damage with control of events and strong internal borders. By dividing the system or software into sufficiently small units, it is easier to control and manage security features. Division also helps to isolate infections within a single unit.
Another useful control feature is the minimum rights principle, wherein each unit is given only the minimum rights to complete its tasks. Controls can be imposed by authenticating and authoring all traffic between units, and by limiting access rights of unidentified parties. These techniques can be applied from a single software component to an entire business system.
From Symbian OS v9.1 onwards, platform security implements control of events inside the operating system and creates borders for different security areas (for example, by means of data caging and server protection). Platform security also implements the minimum rights principle.
Additionally, there are third-party security applications such as antivirus software, firewalls, and intrusion detection systems that provide good protection against hostile attacks when combined with strict policies.
Even the strongest security systems may have vulnerabilities which are not apparent until the application or product is in use. Software complexity and combinations of different technologies are known to increase the chance of software flaws. Software usually functions properly even when it is not secure. This is why extensive testing and validation are needed during development. The purpose of security testing is to find errors and flaws that may jeopardize the security and integrity of information stored in the mobile device.
Traditional testing validates software against specifications, but security testing studies behavior and possible side effects in different environments. For example, white hat hacking attempts to identify vulnerabilities before malicious (black hat) hackers do. Common areas for security testing include user interfaces, information storage, communications, and the software's internal security (for example, algorithms, robustness, recovery).
To have a complete evaluation of security features and risks, it is important to perform a full security analysis for every published version of an application.