Upload File

mobile app security techniques and traps - goto conference · mobile app security techniques and...

  • Home
  • Documents
  • Mobile App Security Techniques and Traps - GOTO Conference · Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22
29
Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22 May 12

Upload: others

Post on 27-Jul-2020

2 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Mobile App Security Techniques and Traps - GOTO Conference · Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22

Mobile App Security Techniques and Traps

Graham Lee / @secboffinSmartphone Security Boffin, The Lab @O2

Tuesday, 22 May 12

Page 2: Mobile App Security Techniques and Traps - GOTO Conference · Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22

No code

Tuesday, 22 May 12

Page 3: Mobile App Security Techniques and Traps - GOTO Conference · Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22

No code

Tuesday, 22 May 12

Page 4: Mobile App Security Techniques and Traps - GOTO Conference · Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22

State of the Union

Tuesday, 22 May 12

Page 5: Mobile App Security Techniques and Traps - GOTO Conference · Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22

State of the Union

• 1875: UK patent application for telephone

Tuesday, 22 May 12

Page 6: Mobile App Security Techniques and Traps - GOTO Conference · Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22

State of the Union

• 1875: UK patent application for telephone

• 2007: Phones got good enough to be useful

Tuesday, 22 May 12

Page 7: Mobile App Security Techniques and Traps - GOTO Conference · Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22

State of the Union

• 1875: UK patent application for telephone

• 2007: Phones got good enough to be useful

• 2009ish: Cell networks got good enough to use phones on

Tuesday, 22 May 12

Page 8: Mobile App Security Techniques and Traps - GOTO Conference · Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22

State of the Union

• 1875: UK patent application for telephone

• 2007: Phones got good enough to be useful

• 2009ish: Cell networks got good enough to use phones on

• Despite apparent novelty, most security problems already existed:

Tuesday, 22 May 12

Page 9: Mobile App Security Techniques and Traps - GOTO Conference · Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22

The problems

Tuesday, 22 May 12

Page 10: Mobile App Security Techniques and Traps - GOTO Conference · Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22

The problems

• Who gets to see/change my data?

Tuesday, 22 May 12

Page 11: Mobile App Security Techniques and Traps - GOTO Conference · Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22

The problems

• Who gets to see/change my data?

• I like sharing things, but only on my terms.

Tuesday, 22 May 12

Page 12: Mobile App Security Techniques and Traps - GOTO Conference · Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22

The problems

• Who gets to see/change my data?

• I like sharing things, but only on my terms.

• (these are the same problem stated twice)

Tuesday, 22 May 12

Page 13: Mobile App Security Techniques and Traps - GOTO Conference · Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22

Tuesday, 22 May 12

Page 14: Mobile App Security Techniques and Traps - GOTO Conference · Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22

What are my concerns?

Tuesday, 22 May 12

Page 15: Mobile App Security Techniques and Traps - GOTO Conference · Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22

What are my concerns?To how much effort will I go?

Tuesday, 22 May 12

Page 16: Mobile App Security Techniques and Traps - GOTO Conference · Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22

What are my concerns?To how much effort will I go?

Will no-one think of the children?

Tuesday, 22 May 12

Page 17: Mobile App Security Techniques and Traps - GOTO Conference · Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22

What are my concerns?To how much effort will I go?

Will no-one think of the children?

Tuesday, 22 May 12

Page 18: Mobile App Security Techniques and Traps - GOTO Conference · Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22

Tuesday, 22 May 12

Page 19: Mobile App Security Techniques and Traps - GOTO Conference · Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22

Tuesday, 22 May 12

Page 20: Mobile App Security Techniques and Traps - GOTO Conference · Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22

Tuesday, 22 May 12

Page 21: Mobile App Security Techniques and Traps - GOTO Conference · Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22

Tuesday, 22 May 12

Page 22: Mobile App Security Techniques and Traps - GOTO Conference · Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22

Tuesday, 22 May 12

Page 23: Mobile App Security Techniques and Traps - GOTO Conference · Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22

Tuesday, 22 May 12

Page 24: Mobile App Security Techniques and Traps - GOTO Conference · Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22

Top Tips

Tuesday, 22 May 12

Page 25: Mobile App Security Techniques and Traps - GOTO Conference · Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22

Top Tips

• Express security issues as (testable) user stories

Tuesday, 22 May 12

Page 26: Mobile App Security Techniques and Traps - GOTO Conference · Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22

Top Tips

• Express security issues as (testable) user stories

• Iterate

Tuesday, 22 May 12

Page 27: Mobile App Security Techniques and Traps - GOTO Conference · Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22

Top Tips

• Express security issues as (testable) user stories

• Iterate

• Plan your response strategy (particularly release management)

Tuesday, 22 May 12

Page 28: Mobile App Security Techniques and Traps - GOTO Conference · Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22

Top Tips

• Express security issues as (testable) user stories

• Iterate

• Plan your response strategy (particularly release management)

• Don’t leave it to the pen tester

Tuesday, 22 May 12

Page 29: Mobile App Security Techniques and Traps - GOTO Conference · Mobile App Security Techniques and Traps Graham Lee / @secboffin Smartphone Security Boffin, The Lab @O2 Tuesday, 22

Further Reading

Graham Lee / @secboffinSmartphone Security Boffin, The Lab @O2

•OWASP Mobile: https://www.owasp.org/index.php/OWASP_Mobile_Security_Project•GSMA Privacy Guidelines: http://www.gsma.com/publicpolicy/mobile-and-privacy/design-guidelines/

Tuesday, 22 May 12

https://www.owasp.org/index.php/OWASP_Mobile_Security_Project
https://www.owasp.org/index.php/OWASP_Mobile_Security_Project
https://www.owasp.org/index.php/OWASP_Mobile_Security_Project
https://www.owasp.org/index.php/OWASP_Mobile_Security_Project
http://www.gsma.com/publicpolicy/mobile-and-privacy/design-guidelines/
http://www.gsma.com/publicpolicy/mobile-and-privacy/design-guidelines/
http://www.gsma.com/publicpolicy/mobile-and-privacy/design-guidelines/
http://www.gsma.com/publicpolicy/mobile-and-privacy/design-guidelines/

Cloud App Security Proof of Concept Playbook · Cloud App Security Proof of Concept Playbook Learn how to quickly implement Microsoft Cloud App Security Prepared by Yoann Mallet Sr

Mobile App Security: A Review

AVOID THESE 7 APP TRAPS AND GET IT RIGHT - SPR · 2017-11-21 · MARKETERS NEED MOBILE! AVOID THESE 7 APP TRAPS AND GET IT RIGHT 1 SHARE THIS VIA: Mobile apps are hot. Beyond hot

Migration Guide: SAFE by Swann App to Swann Security App · For more information, see "2.3 Get the Swann Security App" on page 6. 11. While using the Swann Security app, you can access

SonicWall Cloud App Security - Your Value Added ... Cloud App Security Datas… · SonicWall Cloud App Security • Full integration with Office 365 or G Suite • Total mailbox

Openflow App Security

Addressing Challenges In App Security

Web App Security I

Php web app security (eng)

Xerox: Improving Data & App Security

Web app security

Traps and Pitfalls: Practical Problems in System Call Interposition Based Security Tools

Pactera - App Security Assessment - Mobile, Web App, IoT - v2

Mobile App Security Best Practices

GanzView App Guide - Ganz Security

Real-World Web App Security

windows azure app fab security

Mobile App Security: How Secure is your Mobile App

Web app security part 1

State of Security App Economy

SECURITY CHALLENGES FOR BANKS - accenture.com · OPEN WEB APP SECURITY ... review, app fuzzing, and pen-testing of apps to confirm whether security ... SECURITY CHALLENGES FOR BANKS

Mobile App Security and PaymentsFeb 08, 2012  · Mobile App Security and Payments Overview of mobile app security issues and mitigation strategies !

Android mobile app security offensive security workshop

SonicWall Cloud App Security...SonicWall Cloud App Security Securing cloud application usage through visibility and control SonicWall Cloud App Security is a cloud service that provides

Whats app security

Guidelines Mobile App Security Testing

Web App Security Standard

Automated Mobile App Security Testing

App Security Guide

Carbon Black App for IBM Security QRadar · PDF fileCarbon Black App for IBM Security QRadar Stay ahead of emerging threats with IBM Security and Carbon Black The IBM Security App

Mobile App Security: Enterprise Checklist

Project 2: Web App Security

Risspa business-app-security

Web App Security Slides

Four Deadly Traps in Using Information Security Frameworks