Mobile application security testing involves testing a mobile app in ways that a malicious user would try to attack it. Effective security testing begins with an understanding of the application’s business purpose and the types of data it handles. From there, a combination of static analysis, dynamic analysis, and penetration testing results in an efficient holistic assessment to find vulnerabilities that would be missed if the techniques were not used together effectively. The testing process includes:
- Interacting with the application and understanding how it stores, receives, and transmits data.
- Decrypting encrypted parts of the application.
- Decompiling the application and analyzing the resulting code.
- Using static analysis to pinpoint security weaknesses in the decompiled code.
- Applying the understanding gained from reverse engineering and static analysis to drive dynamic analysis and penetration testing.
- Utilizing dynamic analysis and penetration testing to evaluate the effectiveness of security controls (e.g., authentication and authorization controls) that are used within the application.
There are a number of free and commercial mobile application security tools available that assess applications using either static or dynamic testing methodologies with varying degrees of effectiveness. However, no single tool provides a comprehensive assessment of the application. Rather, a combination of both static and dynamic testing with manual review is required to provide the best coverage.
Mobile application security testing can be thought of as a pre-production check to ensure that security controls in an application work as expected, while safeguarding against implementation errors. It can help discover edge cases (that turn into security bugs) that the development team may have not anticipated. The testing process takes into account both code and configuration issues in a production-like environment to ensure that issues are discovered before going live.