What is Mobile Application Security?
Mobile application security focuses on the software security posture of mobile apps on various platforms like Android, iOS, and Windows Phone. This covers applications that run both on mobile phones as well as tablets. It involves assessing applications for security issues in the contexts of the platforms that they are designed to run on, the frameworks that they are developed with, and the anticipated set of users (e.g., employees vs. end users). Mobile applications are a critical part of a business’s online presence and many businesses rely entirely on mobile apps to connect with users from around the world.
More users than ever before rely on mobile applications for a majority of their digital tasks over traditional desktop applications. In 2015 in the U.S. alone, users spent 54% of their digital media time on mobile devices actively using mobile apps. These applications have access to large amounts of user data, much of which is sensitive data and must be protected from unauthorized access.
All popular mobile platforms provide security controls designed to help software developers build secure applications. However, it is often left to the developer to choose from myriad of security options. A lack of vetting can lead to security feature implementation that can be easily circumvented by attackers.
Common issues that affect mobile apps include:
- Storing or unintentionally leaking sensitive data in ways that it could be read by other applications on the user’s phone.
- Implementing poor authentication and authorization checks that could be bypassed by malicious applications or users.
- Using data encryption methods that are known to be vulnerable or can be easily broken.
- Transmitting sensitive data without encryption over the Internet.
These issues could be exploited in many ways; for example, by malicious applications on a user’s device, or by an attacker who has access to the same WiFi network as an end user.