- In the first course part of the series,
you learn about an organization called OWASP, right?
Now if you're not familiar with this organization,
I'll definitely invite you to view the first course
or just to go to their website at owasp.org.
Now OWASP has an initiative called
the OWASP Mobile Security Project,
and it basically is a centralized resource
aimed to give developers and security teams
the resources actually need to build
and maintain secure mobile applications, right?
And of course extends more than the mobile application,
but they actually are focusing in this specific initiative
around mobile devices and mobile applications, right?
Now through the project,
their goal is actually to classify mobile security risk
and provide developmental controls
to be able to reduce the impact
or the actual likelihood of, you know,
exploitation of vulnerabilities in mobile devices.
Now their primary focus is at the application layer, right?
They also take into consideration
the underlying mobile platform, right?
So the actual hardware itself,
and also even the service provider risk,
whenever they actually, you know,
are doing the threat modeling
and building controls, right?
Now they also cover not only
the mobile applications deployed in the end user devices
but also the broader server site infrastructure
in which the actually the mobile applications actually
will communicate too, right?
So in a lot of cases
actually these mobile applications
are communicating to the Cloud, right?
So they also look at that communication
from the mobile device and the Cloud environment.
They also cover best practices and vulnerabilities
around the integration between the mobile application,
the remote authentication servers,
and the actual Cloud platform specific features, right?
Now let's take a look at some of the top security
vulnerabilities and through it
that are assist for mobile devices in their website.
If you look at the OWASP Mobile Security Project website,
you will find tons of resources
related to mobile security, right?
So the website includes the top 10 mobile risk,
and we will review those in a minute, right?
So now it also includes mobile security checklist,
a mobile security testing guide,
a set of tools that they actually call M-Tools
that allows you to of course, you know,
test the security of mobile devices,
guidance for secure mobile device, you know, development.
And also the top 10 mobile controls
and a project that is dedicated to teach you
how to perform threat models for mobile devices.
Now, if you click on the Top 10 Mobile Risk,
you will see that the current top 10 vulnerability
or risk types for mobile devices are the following.
And number one is actually improper platform usage, right.
Insecure data storage, insecure communication,
insecure authentication, insufficient cryptography,
and this is actually one of the challenges nowadays
because a lot of people are actually trying
to create their own crypto implementation, right?
So whenever you do that
and you don't reuse, you know, some of the, you know,
stronger out there, like, you know, open SSL
and some other ones that actually a lot more maintainers
you know, actually, you know, contribute to them,
you will introduce security problems for sure, right?
So the other ones is not only as far
as the actual core crypto components
but also the implementations of those, right?
So especially whenever you actually do not have
a sufficient cryptography best practices
include into your device, right?
Now, insecure authorization is another one.
Client code quality, code tampering,
reverse engineering,
and extraneous functionality as well, right.
Now this change from time to time, right?
So I definitely recommend for you to do two things.
Keep these resources handy
and also subscribe to the mailing list to get information
about any new threats and perhaps, you know,
you can even contribute to the project.
Personally, actually I belong
to the local OWASP chapter
here where I live,
and I invite you to do the same, right?
So this guy is actually not only provide a lot
of references for mobile device security,
but you know a lot of security,
you know, resources and tools
are also share in their website.