Over time, our industry has gotten a better grip on the mobile threat landscape. As it turns out, mobile security is all about data protection: Apps store our personal information, pictures, recordings, notes, account data, business information, location, and much more. They act as clients that connect us to services we use daily and as communications hubs that process every message we exchange with others. Compromise a person’s smartphone, and you get unfiltered access to their life. When we consider that mobile devices are more readily lost or stolen and mobile malware is on the rise, the need for data protection becomes even more apparent.

OWASP Top 10 security threats posed by mobile apps

The OWASP Mobile Top 10 is a list of the most common security risks affecting mobile applications.

How to create a secure mobile app

Threat modeling helps you think like an attacker and gain a better understanding of how malicious threat actors can take advantage of your app’s vulnerabilities and exploit them.

OWASP’s four question framework

The Open Worldwide Application Security Project (OWASP) recommends beginning the threat modeling process with a Four Question Framework:

1. What are we working on?
2. What can go wrong?
3. What are we going to do about it?
4. Did we do a good job?

The OWASP Mobile Application Security Verification Standard (MASVS) can help you and team to answer these questions, but also guide you to a suitable set of security controls for your mobile application to speed-up your threat modeling.

OWASP Mobile Application Security Verification Standard (MASVS)

The OWASP Mobile Application Security Verification Standard (MASVS) has become the industry standard for mobile application security and is a valuable resource for developers, application owners, and security professionals. OWASP MASVS is the result of years of community effort and industry feedback. It provides a comprehensive set of clear and concise guidelines, best practices, and security controls that can be used to define and assess the security of mobile apps across various platforms (Android and iOS) in various use cases based on your industry-specific threats and mobile app architecture.

Three mobile app security testing profiles: Basic security, defense-in-depth, and resilience

OWASP MASVS provides three mobile app security testing profiles, each defining different security requirements and protection levels for mobile apps. This enables companies and developers to determine the appropriate security levels for their mobile apps and ensure that adequate security measures are implemented to guarantee the integrity and confidentiality of the data processed within the apps. Depending on the app’s use case and security requirements, the corresponding profiles and requirements can be selected or even combined.

MASVS Level 1: Basic security

MASVS Level 1 a good starting point for app developers who want to ensure their apps have at least a foundational level of security. It is typically suitable for apps that deal with lower-risk scenarios and minimal security needs.

MASVS Level 2: Defense-in-Depth

MASVS Level 2, also known as the “Defense-in-Depth”, is designed to address the security needs of mobile applications that require a higher level of protection. This profile is suitable for apps that handle sensitive data, operate in potentially riskier environments, or simply need to adhere to stricter security standards. It is highly relevant for mobile apps that handle personally identifiable information (PII), such as financial or healthcare data, or those that must meet strict regulatory requirements.

MASVS-RESILIENCE: Resilience against reverse engineering and tampering

MASVS-Resilience adds multiple security controls to the app, making it more difficult for attackers to reverse engineer and extract valuable intellectual property or sensitive data from it, which could result in:

Security goals for OWASP-MASVS Resilience

• Ensuring the trustworthiness and integrity of the platform on which the app operates
• Safeguarding the integrity of the intended app functionality
• Impeding analysis through static analysis by obscuring app functionality
• Preventing dynamic analysis and instrumentation that could enable potential code modifications by attackers during runtime

When to consider OWASP MASVS-Resilience against reverse-engineering and app-tampering?

To determine when it is essential to integrate MASVS-Resilience into your mobile app as the top layer of your security concept, consider the nature of your mobile app. If your mobile app includes any of the following assets, data, or functionality, OWASP recommends strengthening your mobile app against reverse engineering and app tampering. This should be done in addition to any basic or defense-in-depth security measures you may have already implemented.

Sensitive business assets and logic	Sensitive data	Sensitive functionality
Intellectual property	Access tokens	Paid/premium features
Patents and copyrights on source code or algorithms	API keys	In-app purchases, subscriptions
Revenue streams	Sensitive PII, e.g. health or financial data	Money transfers
		Upload functions such as medical records or other sensitive files

Comply with OWASP MASVS-Resilience within minutes

Our app shielding software is offered as an on-premise SDK, requires minimal security knowledge, and takes care of the complexities of app security. Promon SHIELD™ can be integrated within minutes and works smoothly with every command line interface or your dev team’s favorite CI/CD tools.

Promon SHIELD™ is an app hardening technology that adds anti-reverse engineering and anti-tampering security features to your mobile app. At the same time, we help you to fulfil the OWASP MASVS-Resilience controls, going far beyond the requirements of the gold standard.

Features of Promon’s technology

OWASP MASVS Resilience controls	Promon’s technology features
The app validates the integrity of the platform	– Emulator detection – Root & jailbreak detection – Detection and blocking of untrusted keyboards, keyloggers, screen readers, abusing the operating system’s accessibility services
The app implements anti-tampering mechanisms	– Runtime integrity checks – Code injection-prevention – Detection of hooking frameworks – Repackaging detection
The app implements anti-static analysis mechanisms	– Anti-debugging – Code obfuscation (Promon IP Protection Pro™) – Data encryption (Promon Asset Protection™)
The app implements anti-dynamic analysis techniques	– Debugger detection – Detection of reverse engineering tools