Nowadays mobile devices dominate the consumer use and habits.
For my personal and enterprise perspective.
Thus they are ubiquitous.
They are found everywhere.
The basic risk segments can be divided into these five main mobile application security categories starting
from the mobile device itself passing through the network security web service security database security
and application management procedures.
The mobile device risk spectrum starts with the data storage is the data on the mobile device encrypted
or not about data transmission.
We can talk HDTV s versus HDP FTB as versus secure FTB.
So is the application utilizing secure protocol versus open protocols.
Reverse engineering is very important.
And when we talk about mobile applications are fed by new protections in place.
If there are no binding protections place anyone can have access to this mobile app and just reverse
engineer it and get the source code and get to know the details of the architecture of the mobile app
and more application access management.
When you install an application you granted access to local resources so are is the application having
access to only the resources it needs or it's having more elevated access.
The other is a mobile attack surface is the network threat itself.
Here we mainly talk about HDTV versus HDTV s using SSL using theories because if we do that it will
cover all the wireless connectivity issues.
You will this allow any hackers from doing session hijacking and DNS spoofing.
Thus we need to know how these technologies work.
Doesn't mean that if you use SSL you're you're safe.
No.
We will see in the examples coming forward that we can decrypt SSL as if we are not using a cell in
the first place.
So we need to know how to use and utilize SSL within our mobile applications.
The other security spectrum is the other web server security.
Do we have any processing them.
Is processes in place to identify the critical system security patches.
Do we have a process in place to assign roles and responsibilities for people who will take the ownership
of their actions performed on the web server.
And do we use prostheses to mitigate US attacks such as capture or do we have best policies in place
to look at attacks and to look at accounts that have been attempting to brute force using incorrect
passwords.
These are trivial threats not only related to the mobile attack service but however it's important to
mention them here.
The other attacks surface is the database threats.
Who has access to our database.
Who can use billing account.
Are we sanitizing the data we're getting from what applications before we insert it into our databases.
Are we checking the logic of the data we're getting from what apps we use utilizing the latest updates
to patch our database and I'll be validating the data and sanitizing the less mobile attack service.
Is the application management threats as you know many enterprise mobile apps are distributed using
application management software.
Those who have access to the application management software who can deploy our source code through
the online stores such as Google Play or Apple Store is our mobile app signed by the enterprise account
and who can or who has the ability to do remote swiping either fully for the mobile devices or partially
only for the organizational data.