Best Practices
Researchers unveiled a startling discovery this week: 41 percent of the most popular Android apps that implement OAuth 2.0 allow an attacker to remotely impersonate any user account, access personal information from within the app, and make in-app purchases on the user’s dime. In this post I explain OAuth 2.0 and how it affects mobile app security and risk.
Security leaders are tasked with quickly and consistently managing mobile risk within and beyond their organization’s walls, a task that will only get more difficult as mobile app usage and development continues to rise. The purpose of this post is to familiarize developers, QA professionals, and security analysts with the OWASP MASVS, as well as provide additional guidance from the NowSecure Secure Mobile Development Best Practices about how to avoid or remediate the top ten risks.
The long-term costs of design choices that maximize short-term convenience. They far outweigh the benefits.
I’ve recently noticed a spike in questions from our customers — and specifically security analysts — about App Transport Security (ATS), or NSAppTransportSecurity, for iOS apps. ATS is a critical security practice for our customers in financial services and other regulated industries. A lot of ATS documentation already exists, but questions persist. A core part […]
Many government agencies are not taking full advantage of the productivity gains and cost savings that can come from using mobile apps, and part of that hesitation probably comes from concerns about security.
Implementing certificate pinning in mobile apps that handle highly sensitive data provides too much benefit to be passed over. Users can be tricked into installing a malicious self-signed certificate on a mobile device, setting the stage for a man-in-the-middle attack. In those situations, certificate pinning can still prevent the interception of an app’s network traffic.
A seeming resurgence in mobile banking Trojans has financial institutions asking questions. NowSecure CTO David Weinstein has answers.
I’ve helped a number of organizations decipher HIPAA but found clear information hard to come by. I tried to remedy that for the mobile app development community with this blog post about HIPAA and mobile apps.
Learn how you can leverage existing automation frameworks to integrate mobile app security testing into your DevOps practice.
Guest contributor Kevin Beaver, CISSP, explains four common mobile app security risks you should know like the back of your hand and how to avoid them.