Securing mobile devices with PicturePIN

BANGALORE: 'Women love flowers daily'. Now, what in the world is that supposed to mean? Well, that's actually a unique picture based information access control, called PicturePIN, for mobile devices such as PocketPCs and PDAs. A patent-pending authentication software from Pointsec, a mobile security solutions provider, PicturePIN consists of a series of pictures that can be randomly manipulated in place of the conventional password.

PicturePIN allows a user to simply point out (with a stylus) pictures on his/her mobile device or smartphone that corresponds to his/her story created around the pictures on the screen. It is as secure as traditional passwords, and is easy to remember, doing away with the need to write down any password. Information is automatically and transparently encrypted using 128-bit AES data encryption without the need for user intervention.

Sascha Bayer, managing director, Pointsec Mobile Technologies AB, says, “The pictures change their positions each time without having to worry about 'shoulder surfers' at airports and other crowded places."

Need for advanced infosecurity

As information becomes more accessible it gets more exposed as well. The need for advanced information security measures has heightened with the drastic rise in data theft activities. Bayer adds the threat of physical data theft is greater than electronic threat. “As per FBI reports, over 50 percent of all malicious attacks are done using stolen devices.”

It is interesting to note that the laptop has reportedly overtaken the umbrella as the object people misplace the most. Most of the time, they contain valuable data. A global survey of 900 taxi drivers indicated that thousands of mobile phones, PocketPCs and laptops are forgotten in taxis every day. For instance, in the last six months in London alone, a staggering 63,135 mobile phones (that's an average of three phones per taxi), 5,838 PocketPCs and 4,973 laptops have been left in licensed taxicabs.

It may probably be difficult to retrieve stolen or misplaced laptops, users could still protect data by a combination of encryption and good passwords. The breather: probably the only value to a thief is from the sale of a laptop and not the data!

There is a typical suite of security solutions for the mobile workforce, such as VPNs, anti-virus, anti-spam, firewalls, intrusion detection and prevention, email security, etc. However, there is a missing link -- access control and encryption of data. This is where Pointsec comes in!

For example, if a disk is either removed or attempted access, encryption would ensure that the data stays secure. Pointsec's solution locks the entire hard disk and OS on encryption. Pointsec for PC combines an enforceable mandatory access control and strong encryption to create an advanced enterprise security solution. User credentials and confidential data remain private, enabling organizations to take advantage of mobile technologies without compromising security.

Pointsec for PC enables an enterprise to enforce its security policy, while providing a security solution that is easy for employees to use. It does not impede either users' or PCs' performance. Pointsec for PC is easily managed and completely scalable, whether implementing 500, 5,000, or even 50,000 units. Encryption is automatic and real-time, and managed centrally, so a user does not have to worry about it. All he needs to bother about is entering an exclusive login and password, says Bayer.

Pointsec, which recently entered the Indian market, offers security solutions for personal computing devices such as laptops, PDAs, smartphones, USB media, memory cards and floppy disks. It plans to set up a sales office in Mumbai and has tied up with Trident Infotech Services as its sales and support partner.

This February, Pointsec for PC was awarded the Evaluation Assurance Level 4 (EAL4) of the Common Criteria, the most demanding international IT security standard. Pointsec for PC achieved the FIPS 140-1 certification in 2002.