A security method (100) in a radio access network can include monitoring (102) (by either a base station controller or a mobile radio) for one or more abnormalities among CPU utilization, memory storage, memory read-write, malicious incoming or outgoing messages, and virus file names, notifying (104) of a specific abnormality detected, and receiving (108) access, conditional access or limited access based on the specific abnormality detected. The method can further include receiving updates (112) used for monitoring the abnormalities. The method can further include the optional step (106) of issuing a notification from a mobile radio to a base station controller if the specific abnormality is detected and suspending (110) one or more services based on the specific abnormality detected. The method can further include receiving (114) at the mobile radio an over the air programming instruction to suspend a specific service and alerting the mobile radio.