A checklist for keeping mobile apps secure

There are more mobile applications on the market than ever due to the increased cellular network broadband speed and the processing power of Android, iOS and other mobile operating systems. And as the devices spread, so does government risk.
In fact, mobile apps rule the network in government, with 35 percent of new federal and state applications and 45 percent of new local applications expected to be mobile this year. As such, mobile application security will be where the rubber meets the road. 
Mobile applications enable new threats to both enterprise and to the device itself. For instance, mobile devices move data from safe networks to untrusted, dangerous ones – effortlessly. By constantly changing wireless networks, such as Wi-Fi, Bluetooth, Global System for Mobile Communications (GSM), and Code Division Multiple Access (CDMA) networks, a safe environment can easily become a danger zone.
Moreover, hackers can hijack sessions through sniffing and tampering, which enables an unauthorized person to access stored data, passwords, cookies and VPN credentials. It also gives the hacker the same full privileges as the device’s owner and, in some cases, can provide the keys to the enterprise. 
While most client-server applications run on a local-area network or a corporate wide-area network, mobile apps run outside the corporate network, accessing services across the public Internet. This broad range of access to mobile applications causes potential security vulnerabilities, especially if applications aren't architected properly.

One of the principal elements of secure design for mobile applications is making sure that the client, the actual device itself, or the browser application, does very little processing; in effect, making it a dumb device.
Another best practice for mobile applications involves encrypting traffic to the backend server by using Secure Sockets Layer encryption. But SSL alone isn't enough because of the nature of mobile device connections. Many smart phones will automatically connect to available, open Wi-Fi networks to which they have connected before. This makes it easy for the network to connect to a rogue device that is acting as an SSL proxy, decrypting and re-encrypting traffic and recording everything that passes through. Hence, the network falls prey to a “man in the middle” attack.
Application development should also be evaluated when securing mobile applications. All too often, the only thing identifying an incoming access request as a legitimate mobile application is a developer key. When the requests come in, there's no way to identify the user. Developer keys are often used by organizations that allow outside applications to access their data through a published Application Programming Interface (API). This is just one of many security elements that will need to be addressed when trying to secure mobile applications.
A partial list of necessary measures that an agency must take to make the mobile application more secure includes:

• Ensure that the registration and activation process is robust.
• Enable user authentication – use strong passcodes and implement account lockout.
• Ensure that two-factor authentication is enabled.
• Avoid storing sensitive data on the device.
• Enable permanent deletion of user data.
• Avoid insecurely transmitting sensitive user data over WiFi networks.
• Ensure that the most robust version of SSL is correctly implemented and enforced.
• Ensure that the application will be able to prevent Web framing, hijacking and related attacks.
• Address platform security risks, including keychain on iPhone (option to store passwords).
• Maintain security of the backend APIs (services) and the platform (server).
• Ensure secure distribution and provisioning of mobile applications.

The bottom line is to be vigilant in all areas of mobile application security, to include vulnerabilities and to conduct necessary research before outlining a mobile defense strategy. Seek professional help from certified vendors where needed. As government agencies advance in their use of information technology, they cannot expect their security departments to be full of experts in every area, especially in this new era of mobility.

One of the principal elements of secure design for mobile applications is making sure that the client, the actual device itself, or the browser application, does very little processing; in effect, making it a dumb device.
Another best practice for mobile applications involves encrypting traffic to the backend server by using Secure Sockets Layer encryption. But SSL alone isn't enough because of the nature of mobile device connections. Many smart phones will automatically connect to available, open Wi-Fi networks to which they have connected before. This makes it easy for the network to connect to a rogue device that is acting as an SSL proxy, decrypting and re-encrypting traffic and recording everything that passes through. Hence, the network falls prey to a “man in the middle” attack.
Application development should also be evaluated when securing mobile applications. All too often, the only thing identifying an incoming access request as a legitimate mobile application is a developer key. When the requests come in, there's no way to identify the user. Developer keys are often used by organizations that allow outside applications to access their data through a published Application Programming Interface (API). This is just one of many security elements that will need to be addressed when trying to secure mobile applications.
A partial list of necessary measures that an agency must take to make the mobile application more secure includes: