Mobile Application Security and the Measures to Take

Mobile applications have made a major leap forward and are now widely used. The spread and popularity of mobile applications concern not only end users but also companies and institutions.

Mobile application security focuses on the software security of mobile applications on various platforms such as Android, iOS and Windows Phone. As the importance of cyber security and IT security has grown, the security of mobile applications has also come to the fore.

Many businesses rely entirely on mobile applications to connect with users around the world. The ever wider adoption of mobile devices has led to remarkable growth in the mobile application sector. As a natural consequence, the security of these applications has also gained importance.

All popular mobile platforms provide security controls designed to help software developers build secure applications. However, choosing among the countless security options is usually left to the developer.

When a malware attack takes place, the following consequences may arise:

• Account takeover
• Stolen login credentials
• Unauthorised access to business networks
• Identity theft

Mobile applications generate enormous amounts of data about individuals and their lives. It is therefore very important to ensure that applications create, store and use this information securely. In this context, solutions such as identity verification, strong authentication and biometric authentication can be used.

Strategies for reducing mobile application security risks:

• Restricting communication between applications, limiting access and applying restrictive file permissions,
• Applying encryption effectively in data storage and protecting the encryption keys,
• Obtaining SSL/TLS certificates from authorised certificate providers and using them,
• Using server-side authentication methods instead of local authentication,
• Using strong cryptographic standards (as recommended by the National Institute of Standards and Technology, NIST),
• Not storing or saving sensitive data on the device,
• Verifying that requests to back-end processes come from the identified user,
• Checking the roles, privileges and permissions of the authenticated user,
• Using understandable, well-documented code and testing it sufficiently,
• Applying digital signatures, code hardening and checksums,
• Preventing reverse engineering. In other words, attackers should not be able to understand how the application works.
• Log records should not contain overly descriptive information about the back end.

It is a more appropriate approach to treat the OWASP list of mobile vulnerabilities as a starting point. Fixing these vulnerabilities is only the minimum. To secure mobile applications, it should be borne in mind that the list must be treated as a starting point and taken further. (Update: the OWASP Mobile Top 10 was revised in 2024.)