If I could ingrain one piece of security wisdom into the minds of mobile application development teams, it would be, "Don't depend on the security of the device for which you're developing." An attacker can leverage too many variables to construct an attack and compromise a mobile device. And as much as they might like to, any one development team can't control all of those variables.
Developers should operate under the assumption that the device on which their app might reside DOES contain malware or WILL be compromised as I mentioned during my recent presentation, "Securing Mobile Apps: Old School Know-How for the New World Order." You can watch a recording of the presentation here.
If a device has your application installed and that device is stolen or compromised by malware, is your application or your application's data valuable to the attacker? Getting yourself into the mindset of an attacker will help you protect your application. What data is your application handling? How might an attacker monetize that data? During many of our mobile application penetration tests, we find that the developers didn't consider the data handled by their application to be confidential or valuable to a criminal.
This underscores the importance of regular security testing of a mobile application throughout the development lifecycle. A penetration test of your application puts an ethical hacker, for instance an expert from Trustwave SpiderLabs, on your team. That individual thinks like an attacker and will alert you to weaknesses in your app's security and any data handled by the application that might be valuable. The test will also include steps to determine whether the back-end systems that your application interacts with expose your application to a hack.
Watch a recording of my presentation here and learn more about my two other security priorities for mobile application developers.
Charles Henderson is the East Coast Practice Director for SpiderLabs at Trustwave. His team specializes in application security including application penetration testing, code review, and training in secure development techniques.
