Mobile Application Security by Design

Mobile Application Security by Design

• 1.
  MOBILE APPLICATION SECURITY BY DESIGN
• 2.
  WHY SHOULD SECURITYMATTER? Mobile security breaches have affected more than two-thirds (68 percent) of global organizations in the last 12 months, according to a study from BT. This is something that can cause both reputational and economic harm for you as a business. So does this mean we all need to get ourselves a Blackphone? We don’t think so. In this presentation we provide you with a comprehensive break down of the different security threats that are out there, help you assess where you stand, and explain why you should consider using Security by Design for all your mobile applications.
• 3.
  SECURITY AGAINST WHAT? Unauthorizedaccess to corporate or personal data Unauthorized use of user’s privacy protected data and information (e.g. location) Theft of funds, banking credentials, or credit card numbers Stealing of user corporate or personal credentials Hacker compromising end user’s devices as conduit to corporate network Hacker accessing mobile device features and other applications Loss of productivity (e.g. when environment is not stable or employees battery is drained out) Regulatory violations
• 4.
  WHAT KIND OFTHREATS ARE OUT THERE? (WEB VS. NATIVE) There are different types of risk level linked to different platforms. For example: Computers have viruses and malware that come from malicious code spawned from opening a document, running a script on a web site, or launching an executable. Mobile devices don’t yet have this risk; their primary risk are the applications being executables themselves, trying to access data on the phone, or in the case of Android, embedding itself deep into the operation system in something called a rootkit.
• 5.
  WHAT KIND OFTHREATS ARE OUT THERE? (EXT. VS. INT.) External threats Hackers, organized crime, corporate espionage: these people are looking at stealing money from financial transactions, intellectual property, credentials or personal profiles they can sell, or getting a foothold into a corporate network to be able to better access one of the above assets of value. Internal threats Users who are authorized to use systems and access data with applications. However, they can intentionally or unintentionally amplify their privilege, or perform functions that they should not be authorized to do. This would allow them to view, delete, or steal data they shouldn’t have access to.
• 6.
  HOW TO ASSESSWHERE YOU STAND? (PART 1 OF 2) Understand your current plans and also future plans for security in: Infrastructures This may include the overall network infrastructure, internet points of presence, mobile gateways, and business continuity contingencies. Implement encryption and other secure mechanisms in place for both the transport and storage of data. Security policies These policies should support regulatory requirements as well as industry best practices. This includes ISO 27001:2013 requirements as well as Data Security implementation. Examples of this include utilizing physical security measures such as passwords to control access to data, establishing monitoring processes for user access rights and roles at regular intervals, and creating procedures to ensure security eve
• 7.
  HOW TO ASSESSWHERE YOU STAND? (PART 2 OF 2) Development, Testing and QA This should assess the process for development, system testing & QA, security testing and deployment process. Environment The environment should be adequate to needs and mitigate the risks. Mobile environments should have fail-over site to ensure redundancy and high availability. Training of employees Training of employees will increase compliance to security policies and decrease breaches caused internally. Education of users Users can be customers or employees. There should be transparency towards the users of your mobile apps about the level of security that can be expected within your application. This should be communicated within the user journey.
• 8.
  KEY RECOMMENDATION: SECURITYBY DESIGN Think security at all stages of app development. Mobile application development should include security checks within the development life cycle, including design, testing and QA process. Preventive maintenance should be performed to regularly improving the codes of the apps.
• 9.
  CASE STUDY: CEMEX GoalIdentify potential security risks and propose recommendations to mitigate these while identifying immediate activities that would aid CEMEX in securing its mobile environment. Solution Golden Gekko (A DMI Company) performed a risk assessment of CEMEX’s mobile infrastructure and architecture, CEMEX’s mobile app development process and two existing apps, Sales 360 and MyCEMEX. Results Golden Gekko (A DMI Company) put forward a proposal with key activities to safeguard CEMEX’s Mobile environment.
• 10.
  TRUSTED AQUA PARTNER TheApp Quality Alliance (AQuA) is the mobile industry’s organization supporting quality app development. Golden Gekko (A DMI Company)’s Trusted Status endorsement means that our app development services and QA practices have been assessed, validated and endorsed by AQuA in a stringent process that ensures only the highest quality output. “Golden Gekko (A DMI Company)’s approach of agile software development life and iterative QA processes demonstrate that they share our vision when it comes to developing real quality in the app market.” – Martin Wrigley, Executive Director, AQuA
• 11.
  Text goes here. WHYDO IT? INTERESTED IN DOING A MOBILE SECURITY AUDIT OF YOUR COMPANY? WANT TO LEARN MORE ABOUT HOW TO PROTECT YOUR CUSTOMERS’ DATA AND HELP MANAGE THEIR PRIVACY? CONTACT US FOR A CALL OR MORE INFORMATION. web www.goldengekko.com email info@goldengekko.com