Risk Management for Mobile Applications
When to assess mobile application security?
There are some good practices when to test a mobile application, e.g.
- after any significant change in the code
- when results of last test are outdated and no longer acceptable
- with the arrival of new attacks
- to demonstrate compliance with internal or external requirements, e.g. OWASP, PSD2, PCI or GDPR.
This can be achieved by two different, but complementing approaches: automated testing and manual penetration testing.
Automated Mobile Application Security Testing (MAST)
Mobile Application Security Testing can be performed automatically using tools.
We have developed esChecker, a solution that offers a fast and interactive testing facility for the binary release candidate. esChecker can be seamlessly integrated into the CI/CD tool chain to validate that all protections required are available and effective before releasing the mobile application. Within one hour, you can determine that the app is meeting your security baseline.
Manual Mobile Application Penetration Testing
Mobile app penetration tests start where automated mobile application security testing ends.
The mobile application penetration test analyzes the resistance of the implemented protections against real-life attacks and in-depth. With a penetration test, you gain detailed insights into and a rating of the resistance of the mobile application against an attacker.
Both testing approaches, automated and manual testing, are key components of balanced mobile applications risk management.
Security testing customized to your requirements and needs
We perform mobile application security testing tailored to your needs and requirements. For this, we may take your and third-party requirements into account, e.g.
- your customer’s and business partner’s requirements,
- industry requirements (e.g. PCI, EMVCo, American Express, Mastercard and Visa requirements),
- best practices (e.g. OWASP) or
- legal requirements (GDPR, regulatory), to demonstrate your compliance with.
Or, we go beyond compliance requirements and perform an in-depth penetration test to determine the resiliency of your mobile app against attackers and risk of a compromise.
Interested in automated verification of protections in your mobile application and integration in your CI/CD?
Are you looking for an in-depth mobile application penetration test to determine the risk of being compromised?
A vulnerability in the mobile application API could correspond to a vulnerability in the backend.
We share knowledge within our esCoaching training solution which provides a pathway from the Android and iOS basics to the advanced attacker techniques.
