Endpoint

10/5/2017
11:40 AM
Dawn Kawamoto
Dawn Kawamoto
Slideshows
50%
50%

10 Steps for Writing a Secure Mobile App

Best practices to avoid the dangers of developing vulnerability-ridden apps.
Previous
1 of 11
Next

Image Source: Pedrosek via Shutterstock

Image Source: Pedrosek via Shutterstock

More than 4 million mobile apps are currently in production, but only 29% on average are tested for bugs, and nearly a third of these contain significant vulnerabilities, according to a recent Ponemon Institute survey.

Enterprises, meanwhile, are expected to accelerate their mobile app development in the coming months, according to a recent Gartner survey. On average, enterprises deployed eight mobile apps from the start of the year, with nearly nine more on tap or planned through June, the survey found.

"Developers are less careful when developing apps for internal use because they want to develop it fast, so it can achieve some purpose," says Vivien Raoul, chief technical officer and co-founder of Pradeo, which recently published the Mobile Application Security Guide.

Whether enterprises are developing mobile apps for internal use or to aid customers in using their service, they face consequences if a mobile app is vulnerable security-wise. In addition, organizations whose apps are for customers stand the risk of getting hit with a civil complaint if the apps aren't up to snuff security-wise.

The Federal Trade Commission, for example, has been slapping companies with civil lawsuits over the way enterprises have handled the security of their mobile app development efforts. Enterprises that have felt the FTC's wrath include Upromise, Credit Karma, and Fandango.

Here are key steps for creating a secure enterprise mobile app:

 

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET's ... View Full Bio

Previous
1 of 11
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
12 Free, Ready-to-Use Security Tools
Steve Zurier, Freelance Writer,  10/12/2018
Pair of Reports Paint Picture of Enterprise Security Struggling to Keep Up
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/11/2018
New Domains: A Wide-Open Playing Field for Cybercrime
Ben April, CTO, Farsight Security,  10/9/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-18324
PUBLISHED: 2018-10-15
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has XSS via the admin/fileManager2.php fm_current_dir parameter, or the admin/index.php module, service_start, service_fullstatus, service_restart, service_stop, or file (within the file_editor) parameter.
CVE-2018-18322
PUBLISHED: 2018-10-15
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Command Injection via shell metacharacters in the admin/index.php service_start, service_restart, service_fullstatus, or service_stop parameter.
CVE-2018-18323
PUBLISHED: 2018-10-15
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Local File Inclusion via directory traversal with an admin/index.php?module=file_editor&file=/../ URI.
CVE-2018-18319
PUBLISHED: 2018-10-15
** DISPUTED ** An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because api.php has an eval call, as demonstrated by the /6/api.php?function=command&class=remote&Cc='ls' URI. NOTE: the vendor indicates that Merli...
CVE-2018-18320
PUBLISHED: 2018-10-15
** DISPUTED ** An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because exec.php has a popen call. NOTE: the vendor indicates that Merlin.PHP is designed only for use on a trusted intranet network, and intentionally allo...