Member Article

What You Need To Know About Mobile App Security In 2017

Mobile has taken the front-seat when it comes to customer engagement. In 2016 mobile was the driving force behind most technology and innovation ideas. However, with this ubiquity, the year also highlighted some chinks in the armor – namely security risks. Apple had its first major safety issue with Xcode (the vulnerability called XcodeGhost). 2016 also witnessed some of the worst denial of service attacks – where the attack was launched not from servers or PCs but from commands sent from millions of infected devices.

And 2017 is believed to be a more difficult year in terms of security threats. Entrepreneurs are now aware of the implications of security lapses and the damage it can cause to their business. So, what are some security recommendations that developers and entrepreneurs need to be take note of? Let’s analyze:

**1. Securing Apps Code From The Ground Up ** App security shouldn’t be an afterthought. Mobile software security should be a priority at concept level. Native apps operate differently from web apps, where the data and software exist securely on a server and the client-side is just an interface. In native apps, the code resides on the device once downloaded thereby making it easy for hackers and cyber criminals. Network and data security components are very essential to overall security, but security starts with the app itself. Vulnerabilities are often caused by developer error, poor testing of code, or your app may just be targeted specifically by a hacker. Needless to say, protect your app code with encryption. Adhere to recent, well-supported algorithms coupled with API encryption. Run source code scanning and test for vulnerabilities.

2. Weak Server Side ControlsMobile developers often neglect traditional server-side security considerations. Weak server side controls not only damage the application but also the organization behind the app. The major issue with weak server side controls is that the app communicates with an insecure backend – giving unauthorized users access to data. So ensuring the server’s security is one of the most important criteria when developing and deploying an app. Here are some tips on server side control:

• Never trust the client
• Carefully design server-side controls to mobile devices
• Never use client applications to enforce access control

3. Improper Platform UsageMobile platforms offer a wide range of services from authentication to secure data access to storage of sensitive information on your device. This includes things like the use of key OS components like TouchId, keychain or other security controls that the mobile OS has in place for the app. If a developer fails to use these features or use them correctly, it can allow an attacker to steal sensitive information from the device or when the application interacts with the backend server. To avoid this, use secure coding and configuration practices on the server-side of the mobile application.

4. Insecure AuthenticationApps need a secure user identification system considering that users often call and share sensitive and confidential information over their devices. Threat agents exploit authentication vulnerabilities typically with automated attacks that use available or custom-built tools. This has severe implications for businesses including reputational damage, information theft and unauthorized data access.

You can avoid this by following some golden rules: When porting a web app to its mobile version, authentication requirements of mobile apps should match those of the web app components. It shouldn’t be possible to authenticate with lesser validation factors than the web browser. Also ensure that all authentication requests are performed server-side where possible. Once verified all app data will be loaded on to the mobile device.

SummaryThere are many guidelines and strategies to ensure mobile application security such as application white listing, ensuring transport layer security, sandboxing of applications, the list is quite exhaustive. Whether you develop apps using PhoneGap for cross-platform compatibility or you build native apps, security needs to be integrated in your design and build. Do you have some other ideas to enforce app security? Please let us know in the comments section.

This was posted in Bdaily's Members' News section by Technoblogger .