Five App Security Considerations Before Releasing to the Public
By: Jimmy Soh
Tags: Security, Digital Transformation, Technology, Innovation, Startup

Five App Security Considerations Before Releasing to the Public

Ensure that vulnerabilities are properly addressed through a security assessment before your application goes live

Photo by NeONBRAND on Unsplash

What is the security assessment about?

Anything can happen when your app gets released to the public. As we don’t know what we don’t know, it’s important to ensure that proper measures are in place to mitigate the risks and application vulnerabilities — through a security assessment and audit.

What does the security assessment and tests cover?

The coverage of the security assessment and tests vary across projects, but they would generally cover the following areas:

Mobile and web application penetration tests : OWASP Top 10 20XX vulnerabilities

: OWASP Top 10 20XX vulnerabilities Infrastructure audit: OS hardening and vulnerability; access controls, auth configurations, security logging

What is the process like?

I will be sharing my experience — at a high level — from an infrastructure engineer’s perspective.

For mobile and web application penetration tests, the application’s IPA and APK files are sent to a security vendor, whereby manual and automated tests will be conducted to discover vulnerabilities.

Infrastructure audit can be slightly different, considering that my project was using a cloud provider to host and manage most of its services. If your project is similar, you would have to adhere to the cloud provider’s rules of engagement and obtain a permit to perform penetration tests on the infrastructure.

My project eventually adopted a manual IT security audit for the infrastructure component, which required me to go through a comprehensive compliance checklist. As for automated tests, approvals have been obtained from the leads to waiver the automated tests in the cloud with the consideration of the cloud provider’s comprehensive compliance coverage of the ISO standards.

After the security vendor has completed the security tests, a report will be generated for the project team to rectify the issues or have the project/client accept the relevant risks.

What are the five key considerations to take note of?

Security audit checklists are often exhaustive and not all the items may be relevant to your project. These are the top five that have stood out in my project:

OWASP Top 10 assessment and mitigation measures: compare the list against your application controls and establish mitigation plans for each of the list items. User access management and controls: appropriate roles and access are assigned to each user with processes in place to manage user onboarding and exit. Application logging at multiple layers: incorporate logging software within mobile applications e.g. Crashlytics, ELK for backend applications, and cloud audit logs for infrastructure. Data management and disaster recovery: categorize and configure sufficient backups for your data and cater for negative events which could affect your application’s availability. Network and communications management: ensure that each of the open ports apart from 80/443 are justified with access restricted to a whitelisted IP range; and communications between mobile/web and backend are secured e.g. via SSL pinning.

I will delve slightly deeper for each of the abovementioned items and attempt to provide some examples.

#1. OWASP Top 10 assessment and mitigation measures

The OWASP Top 10 20XX is a standard awareness document for developers and application security — representing a broad consensus about the most common and critical security risks to applications.

You can protect your application from majority of the threats on the Internet by running through the list of 10 top common vulnerabilities and establish mitigation measures for each of the items.

A sample list is provided below.