Batten down the patches: Six points to take from the FTC settlement with HTC

By now, you’ve read about the FTC’s settlement with HTC — the agency’s first law enforcement action against a mobile device manufacturer.  According to the complaint, when HTC customized the operating systems used on many of its products, it introduced security vulnerabilities that put users’ sensitive information at risk.  In addition to requiring implementation of a comprehensive security program, the proposed order includes a first-of-its-kind remedy:  requiring HTC to develop and release software patches to fix vulnerabilities found in millions of its devices.

The terms of the settlement apply just to HTC, of course.  But there are still points for every company to ponder.  Have you thought through what the case could mean for your business?

A to Z, stem to stern, soup to nuts.  Whatever the cliché du jour, the message remains the same:  Savvy companies build Security By Design into every aspect of their business.  So far, the FTC’s data security cases have involved network security, but the HTC settlement drives home the point that software security is a key component, too.  Furthermore, security isn’t a “one and done” box to check off a TO DO list.  Successful businesses understand that maintaining data security is an ongoing process.  You need people and procedures in place to ensure a continuing commitment.

Clearing customs.  These days it’s common for a product to incorporate software developed by other companies.  Customizing that software is fine as long as it doesn’t undermine security.  As the FTC’s complaint explains, HTC customized the Android operating system on its devices in ways that made the devices less secure — in fact, in some cases subverting security features already there in the original.  That’s one reason why companies need to think about security at every step of the design process.

Listen up!  The tech world is full of researchers, academics, and savvy users who are constantly testing and tinkering with your products.  They’re often the canaries in the coal mine that spot potential problems before companies do.  So it’s wise to keep the lines of communication open.  The FTC’s complaint charged that HTC failed to implement a process for receiving and addressing security vulnerability reports from researchers, academics, or members of the public.  Had HTC been listening, the FTC says it could have moved faster to correct vulnerabilities.  There’s no one-size-fits-all best way to keep the channels open, but it should be part of any effective comprehensive security program.

"Patchables" canon.  This may not be music to your ears, but let's face it:  Glitch happens — and deploying patches is a common way for companies to address security risks after the fact.  But in some instances, it looks like patches aren’t getting to consumers as quickly as they should, leaving users with products that are outdated and vulnerable.  Take a look at what the FTC’s Chief Technologist has to say about the issue.

More than mobile.  The lessons of the HTC settlement extend beyond the mobile device industry.  If you or your clients market connected products — whether it’s the mobile smartphone a consumer is never without, the smart TV in the den, or the smart thermostat on the wall — software security should matter to your business.

Do your bit.  A consumer who has experienced a loss due to a security breach doesn’t always engage in a CSI-style autopsy to determine the precise cause.  Once bitten, they’re twice shy about downloading new apps, buying new devices, or subscribing to new services.  Simply put, a vulnerability downstream or upstream can dry up your business.  That’s why it’s in your interest to lend a hand when there’s something you can do to shore up security, regardless of the cause.  One way you can have an impact:  Participate in the FTC’s June 4, 2013, public forum addressing security threats facing users of smartphones and other mobile technologies.  Suggest topics for discussion or throw your hat in the ring to be considered as a panelist by emailing mobilethreats@ftc.gov by March 28th.

Do you have comments about the proposed HTC settlement?  File them online by the March 22, 2013, deadline.

If you have questions for HTC about your device, you can call the company toll-free at 866-449-8358.