Leveraging the mobile phone

There are huge opportunities to leverage the mobile phone to communicate with your user base. The mobile phone is one of the few devices where you can push a message to your users in real time. Unlike a website or instant messaging application where the user needs to be logged on or email where the user needs first read their email, with a SMS or WAP push message the user can be contacted immediately.
There are many opportunities to leverage the mobile phone for marketing, notifying or prompting users. For instance there are a number of banks like First National Bank's inContact and MTN Banking that send out SMS alerts whenever money is paid from or to your bank account. There are a huge number of companies using SMS messages for marketing messages. There are a number of other uses particularly for two factor authentication like sending an SMS message with a one time pin (OTP) that is entered onto a website during the login process. This proves the user has the mobile phone in addition to knowing the username and password.
With all this added ability comes the inevitable risks. Too many marketing messages will annoy the user. It is therefore essential that the user always has an opt out option. There is also the added risk that the SMS can be spoofed. For instance an SMS can be sent to a user with a WAP link asking them to go to log onto your website, but the link points to a phishing site. This might enable somebody to get hold of a user's password.
So the bottom line is that 'yes' it is a great opportunity to contact your user base, but speak to some consultants who have a strong knowledge about this space before you do so, because there are a lot of pitfalls.

Security for mobile applications

Security capabilities differ considerably depending on the channel used. By channel I mean the technology used for the user interface and the communication mechanism to the back-end application. Some channels allow for no encryption at all and are deemed to be very insecure. A standard text SMS would be such a channel. The text cannot be encrypted so entering a password in an SMS is not a good idea. SMS messages use a store and forward protocol and thus can be intercepted and changed. In addition to this they are left in the 'Sent Messages' list on the users phone. More secure channels such as the SIM Browser solution from Gemalto and Smarttrust allow for data encryption within the SIM card of a GSM mobile phone. The encryption normally used 3DES and a secure key resident on the SIM card. This channel will be extremely secure as the encryption is performed within hardware components. For the MTN Banking run by the MTN mobile operator a Mastercard PIN is entered on the mobile phone.