25.09.2007

Room for improvement for Finns in safer use of mobile phone - Information security guidelines provide advice for consumers in plain language

In recent years, mobile phone users may have become victims of malicious software and minor virus epidemics. Information security attacks against mobile phones have so far been infrequent, but annoying for the users.

Knowledge on the internet's information security issues has increased, and we are better prepared for threats to mobile communications. Providing information to citizens is part of the prevention of information security threats to mobile phones. Therefore, FiCom, DNA, Elisa, Ericsson, F-Secure, Nokia, TeliaSonera Finland and the Finnish Communications Regulatory Authority have, in cooperation, updated the Information Security Guidelines for Mobile Phone Users published in 2006. For the purposes of the update, the players examined the attitudes towards threats to mobile communications.

Survey reveals signs of negligent use of mobile phone

TNS Gallup was commissioned to carry out an interview study of the most typical information security incidents related to the use of mobile phone. The target group of the survey were 15-79-year-old mobile phone users in Finland. The survey was carried out in May of 2007.

The survey asked whether the mobile phone user had changed his or her default PIN code to a code of their own choice. On the store shelf, the default PIN code of a mobile phone subscription is usually 1234 or 0000.

As many as 35% of the respondents had not touched the factory settings. Those who had changed their PIN codes were most likely found among the young and students: in both groups, 73% had added their own PIN code on the phone.

Calls may be made and messages may be sent to the mobile phone in an effort to commit a fraud against the user. The intention behind a call from an unknown number may, for example, be to lure the mobile phone user into calling back to a toll number.

Forty percent of the respondents replied in the affirmative to the question "Will you call back if you have received a call from an unknown number?". Entrepreneurs would call back with the greatest certainty as 67% of them replied in the affirmative. Among those who most often preferred not to call back were the retired: 65% of them replied "No" to the question.

Mobile phone users do not install unknown programs on their phones. Ninety-six percent of the respondents replied in the negative when they were asked "Will you give a permission to install a program on your phone if the phone so suggests, although you do not remember having ordered it?".

The malicious software may repeatedly ask for a permission to install. That is why the user may push any button, including the Yes button, on his or her mobile phone in order to get rid of the annoying request, and simultaneously installs the malicious software on his or her mobile phone. Malicious software may be provided via an open Bluetooth connection, for example.

Information Security Guidelines for Mobile Phone Users give advice in plain language

Information security threats to mobile phones are avoidable by rather simple measures. The guidelines go through the key issues contributing to the safer use of mobile phone. For example, the guidelines remind the reader of the importance of the PIN request, dangerous nature of MMS messages and use of barring and restriction services. A compact vocabulary explains the key mobile phone and information security abbreviations.

The front page of the guidelines presents the three most important steps into the information security of mobile phones. These are:
1. Do not press the Yes button in your mobile phone unless you are sure of the consequences.
2. Destroy any MMS messages from unknown senders without opening them.
3. If a device unknown to you tries to establish a Bluetooth connection, move a couple of tens of metres away from where you are: it will be disconnected immediately.

Section "Operating instructions" gives further details on ways to improve the information security of mobile phones.

Information Security Guidelines for Mobile Phone Users are available on FICORA's website. The printed version of the guidelines is available at the retail stores of operators and local consumer consultants will provide them all around Finland. In addition to the Finnish version, the guidelines are also available online in Swedish and English.

"The guidelines are easy reading. Instead of complicated technological presentations, the guidelines focus on giving advice in plain language on how mobile phone users can protect the phone with simple measures in their daily lives", says Managing Director Reijo Svento from FiCom. In Svento's view, the Information Security Guidelines for Mobile Phone Users released in 2006 has been warmly welcomed not only by ordinary mobile phone users, but also by ENISA, the European Network and Information Security Agency, for example. The updated website and the leaflet campaign contribute to the successful cooperation which aims at providing information to citizens in order to prevent epidemics.

"I am extremely pleased that players participating in the project have been active and willing to provide their expertise and easily comprehensible guidance to mobile phone users. The updated guidelines make it easy for users to learn the basic knowledge in order to ensure the information security of their phones," asserts FICORA Head of IP Networks Sami Kilkkilä.

Further information:

Reijo Svento
Managing Director
FiCom ry
tel. +358 50 60 995

Sami Kilkkilä
Head of IP Networks
Finnish Communications Regulatory Authority (FICORA)
tel. +358 400 717 560

The information security guidelines for mobile phone users have been produced by:

Tietoliikenteen ja tietotekniikan keskusliitto, FiCom ry

Viestintävirasto

DNA Finland Oy

Elisa Oyj

F-Secure Oyj

Nokia Oyj

Oy L M Ericsson Ab

TeliaSonera Finland Oyj