Best Practices
Network Security Configuration is an XML file in which developers customize network security settings for an Android app. Letâs examine several benefits of using Network Security Configuration in Android mobile apps and dive into best practices for implementing this feature.
As organizations dig into secure coding and testing best practices, they quickly discover a variety of sometimes confusing approaches and solutions for mobile app security testing. Security professionals and leaders alike can ease the process of finding the testing tools that best fit their needs by requiring mobile app security standards in their selection criteria.
Understanding how TLS 1.3 protocols will affect mobile development and security practices is critical for any appdev or appsec team.
Eighty percent of the top free iOS apps don’t support App Transport Security – does yours? Don’t delay. Protect your organization and users. Read on for tips on how to transition to ATS support.
This article is the second in a series illuminating the developer’s perspective on mobile app security by guest contributor and developer Evan Rose — managing partner at Rose Digital. The first post covered planning mobile API security, and in this installment Evan explains what developers need to keep in mind as they code their mobile apps. […]
This is part two of three in a series about building a mobile app security program from NowSecure Director of Services Katie Strzempka. Part one defines a mobile app security program and summarizes how to create a high-efficiency team. Part two explains how to choose the right mobile app security testing tools to drive consistency in […]
Certificate Pinning and Hostname Verification: Don’t Get Pinned by a Mobile Man-In-The-Middle Attack
Recent news stories have brought attention to a research paper (âSpinner: Semi-Automatic Detection of Pinning without Hostname Verificationâ) published this week highlighting man-in-the-middle (MITM) vulnerabilities in a number of public mobile apps. The vulnerability springs from a failure to validate that the hostname on the certificate matches the actual host to which an app connects.
There is no denying that mobile applications have become ubiquitous. For many companies, building an app is a foregone conclusion. We have applications for social, for fitness, for productivity, for organization and even for things as sensitive as our finances. We are all increasingly turning over more of our personal information and data to applications […]
Researchers unveiled a startling discovery this week: 41 percent of the most popular Android apps that implement OAuth 2.0 allow an attacker to remotely impersonate any user account, access personal information from within the app, and make in-app purchases on the userâs dime.  In this post I explain OAuth 2.0 and how it affects mobile app security and risk.
Security leaders are tasked with quickly and consistently managing mobile risk within and beyond their organizationâs walls, a task that will only get more difficult as mobile app usage and development continues to rise. The purpose of this post is to familiarize developers, QA professionals, and security analysts with the OWASP MASVS, as well as provide additional guidance from the NowSecure Secure Mobile Development Best Practices about how to avoid or remediate the top ten risks.