Mobile phones started off as a means of improving voice communication. Today, smartphones are de facto minicomputers and can do almost everything a laptop or desktop computer can. Little wonder that they’ve transformed into a tool of business. Ergo, when you build a mobile app, you have to see it as an enterprise application especially as far as security is concerned.
Your users’ data must be protected from malware and hackers. A data breach can irreparably damage your app’s reputation. The fact that there are probably dozens or hundreds of apps that do the same thing as yours means you want to get things right from the get-go. You may not have the money or time to repair your business reputation.
The following are three key security risks you must protect your mobile app from.
Contents
1. Inadequately Protected Data Storage
A sizeable proportion of mobile app developers opt to have user and activity data stored on the client’s device. This can help with app loading and processing speed but is risky as far as data security is concerned.
Client storage isn’t really a sandbox where breaches can be monitored and corrected as they occur. The device is largely outside the app owner’s control. Ergo, if the phone falls into the wrong hands or is taken over by malware, the data stored locally can be retrieved, manipulated and transmitted without authorization. This can lead to regulatory violations, identity theft, and reputational damage.
The best way to protect data on the user’s phone is to ensure your app data has at least two levels of encryption—the basic encryption that comes with the phone OS and a second layer of encryption that’s independent of the OS.
2. Weak Authentication and Authorization
Weak or absent authentication makes it easier for a hacker to access and operate the backend server or mobile app itself anonymously. The primary security mechanism of a mobile phone is a screen lock PIN. Since the PIN is just 4-digits long and is comprised of numbers only, it’s easier for an adversary to guess than a conventional password.
That’s why if you have a mobile app that handles fairly sensitive information, you should have a separate authentication mechanism distinct from the phone’s screen lock PIN. At the minimum, you should require users to provide a valid username and password before they can log in.
Nevertheless, unlike traditional web apps, some mobile applications will enable offline authentication to allow continuous use even when there’s a weak or non-existent internet connection. But this offline authentication can result in loopholes that a hacker can exploit for a full takeover of the user session when an internet connection is eventually available.
Therefore, if your app handles sensitive data, it’s best to restrict use to online mode only. If there’s an unavoidable reason for the app to function in offline mode, you can create an added layer of protection by encrypting the data. You should also leverage monitoring mechanisms such as java logging to pick out unusual app or user activity.
3. Poor Session Handling
Poor session handling refers to the continued availability of a session long after the user has exited the application. Some ecommerce apps allow longer sessions in order to reduce the number of steps the user has to go through if they do return later and choose to complete their purchase. It’s certainly convenient for the end user but is it good for security? Not quite.
Think about what would happen if the phone was stolen. Anyone with physical access to the phone would have the power to run the application just like an authorized user. Fortunately, there’s a sweet spot between privacy and speed—reauthentication for the most important actions. Such actions would include completing a purchase or accessing confidential documents.
That way, you facilitate the seamless return of legitimate users so they can continue what they were doing with few hurdles and without compromising the security of the app or their data. Amazon’s mobile app is perhaps the best example of how reauthentication works.
These three points are certainly not the only things that can compromise your app’s security. The good thing is that these and any other threats can be countered by adhering to best data security practices from the get-go.
