Mobile apps have become an integral part of our lives. We use them for various purposes like confidential data transfer, financial transactions, etc. This ubiquity makes them a target for intruders who can use sensitive data for their own purposes.
Business mobile app security should be among the top priorities for any company. It is an important element of product development and support.
Further on, I will describe several mobile app security best practices to take into account during the development process. That is surely far from a complete and comprehensive list, and you can expand it in your comments.
1. Encrypt the data
Any data that a mobile app exchanges with the server, transfers to third-party services, or saves on the device must be encrypted.
Insecure data storage and transmission are among the most common security vulnerabilities exploited by hackers. If the data is encrypted, intruders will still be unable to use it for their own purposes even in case they steal it.
The less information remains on the device while users run an app, the better. Therefore, we recommend you store only the data an app cannot do without. Moreover, this data must be encrypted anyway.
2. Penetration testing
Penetration testing includes checking for weak passwords, unencrypted data, permissions for third-party services, and various types of intentional attacks on the system that can identify its weakest points and flaws in protection against third-party intrusions.
Finding backdoors in the system is a good practice, as they are a potential threat providing access to outsiders.
Source: SecureOps
3. Use Third-Party Libraries with Precaution
Third-party libraries used by an app get the same set of permissions and restrictions as an app itself. That is why such components can use the permissions granted to the entire app to execute malicious activities. This feature creates certain risks.
Third-party libraries can significantly speed up and simplify the operation process. However, you need to be careful and sift the third-party library code before using it in your app.
4. Use the Principle of Least Privilege
An app should not request accessing permissions from the device to functions unnecessary for its operation. The specific list is determined by app features.
The principle of least privilege dictates that code should only run with the permissions, which it absolutely needs, and nothing more.
The same applies to user rights restrictions. A hacked user account with a wide range of privileges can do a lot of damage. Therefore, you should not provide users with more privileges than it is really necessary (the principle of “need to know”).
5. Use Multi-Factor Authentication (2FA)
User registration and authentication system is a critical element of service security. Many apps use a 4 to 5-digit PIN for authorization, and users come up with that PIN during the registration procedure. Naturally, it is inadvisable to store this PIN as is either on the device or on the server.
In contrast to a regular password login procedure, multi-factor authentication with a code sent by email or SMS greatly increases the application security level.
6. Use Mobile App Fraud Prevention Systems
For instance, when used, an app can send data on users’ geolocations to the server (provided that they have given an app access to it). If any operations are carried out in atypical locations, it is possible to suspend the service until users confirm they actually perform such operations personally.
All important operations and changes to settings have to be confirmed using an SMS code. The number of tries to enter the code should also be limited.
7. Obfuscate to Prevent Reverse Engineering
Code obfuscation is an app security technique, the essence of which is to convert software code into a format difficult for humans to understand. This approach includes encrypting code (partially or completely), renaming classes and variables, and removing metadata able to reveal sensitive data about used libraries or APIs.
In general, “cleaning up” the code before submitting it to production is the best practice. Users do not need comments explaining how a particular function or piece of code works. However, such comments are a great help for intruders when they analyze the product.
8. Test Repeatedly
Mobile app security measures are not limited to the release. It is an ongoing process. New threats are constantly emerging, and new solutions are required to respond to them. Regular app updates and security testing for vulnerabilities help to fix flaws in the code and reduce the probability of data breaches.
The code review process and app security level independent analysis are equally important. To carry out these tasks, you can create your own security testing team or resort to services provided by a third-party company.
Takeaways
To ensure mobile app security, it is necessary to identify the most dangerous vulnerabilities, take them into account at the development and testing stages, and if identified, eliminate and document the issues found to avoid them in the future.
On the other hand, a 100% security level can never be guaranteed. The possibility of an attack will always exist, but the measures described in this article reduce the risks or make it harder for intruders to succeed in their malicious intentions.
Best protected applications are those developed using the security by design approach when security is taken into account on the initial stages of the development process and on.
Top comments (1)
Thanks for posting such a great article it was very helpful.