What security features are built in to the standard Bitcoin software? I have read much of the Bitcoin algorithm and its encryption basis, however little has been said of the software's inherent security.

What solutions are already built in to the software, and what is planned?

Problems I see: 


At the moment it uses IRC networks for locating others. (IRC is fairly insecure and easily taken out with simple DDoS)
Wallets have not been encrypted by default. (Physical or remote access to the hard drive provides anyone with the wallet without even so much as a passphrase.)
Wallets are complex data structures with no backup tools. (They cannot be easily backed up to a physical hard copy or a secured digital copy. At least not without using 3rd party software such as PGP or TrueCrypt.)
The server communication protocols default to plain text instead of SSL or some other encrypted traffic.
Essentially, almost none. But all of the problems aren't really particularly serious or the proposed solutions don't really help anyway.

The latest version of the client doesn't use IRC by default, though it's still supported to help older clients find newer clients. Instead, DNS is used. But these really aren't points of failure because a list of known working legitimate nodes is hard coded into the client. And as soon as you can find one node, it can send you the current list of working nodes anyway.

Wallets aren't encrypted by default, but if they were, we'd be flooded with "I forgot my wallet password" complaints and people would lose their Bitcoins anyway. Also, there are complex technical reasons why password-protecting the wallet won't actually work against the typical threat model (mass distributed malware with specific Bitcoin knowledge).

The client supports a 'backup wallet' command. But the wallet is in BerkeleyDB format. I wish the client had a native wallet format specifically for backups. There is work on fully deterministic wallets, so you can 'backup' your wallet just by knowing a passphrase even with no backup files at all. This is a legitimate issue and one that's being worked on.

The server does default to plain text, but it also defaults to localhost communication only and you must configure a password to run it in server mode. (There's no issue in GUI mode.)

These issues are all being worked on. The client is pretty raw at the moment, definitely.