This is the first lecture of part one, I hope you all know about an organization called us.
If you are not familiar with this organization, I'll explain to you right now.
So the Open Application Security Project or is an online community that produces freely available articles,
methodologies, documentation, tools and technologies in the field of Web application.
Security is also registered as a non-profit organization in Belgium under the name of WPRO VW.
And for more details, visit their website w w w w dot org.
Now, W passed an initiative called the Mobile Security Project, and it is a centralized resource aimed
to give developers and security teams the resources actually need to build and maintain secure mobile
applications and of course, extends more than the mobile applications.
But they actually are focusing in this specific initiative around mobile devices and mobile applications
right now through the project.
Their goal is actually to classify mobile security risk and provide developmental controls to be able
to reduce the impact or the actual likelihood of exploitation of vulnerabilities in mobile devices.
Now their primary focus is at the application layer.
They also take into consideration the underlying mobile platform.
So the actual hardware itself and also even the service provider risk whenever they are doing that type
modeling and building controls right now, they also cover not only the mobile applications deployed
in the end user devices, but also the broader server side infrastructure and which is actually the
mobile applications will communicate to.
So in a lot of cases, actually, these mobile applications are communicating to the cloud.
Right.
So they also look at data communication from the mobile device and the cloud environment.
They also cover best practices and vulnerabilities around the integration between the mobile application,
the remote authentication servers and the actual cloud platform specific features.
OK, now let's take a look at some of the top security vulnerabilities and threats that are exposed
for mobile devices in their website.
If you look at the Mobile Security Project website, you will find tons of resources related to mobile
security.
So the website includes the top end mobile risk and we will review those in a minute.
So now it also includes mobile security checklist, a mobile security testing guide, a set of tools
that they actually can and tools that allows you to test the security of mobile devices, a guidance,
particular mobile device development, and also the top 10 mobile controls and a project that is dedicated
to teach you how to perform track models for mobile devices.
Now, if you click on the top 10 mobile risk, you will see that the current top 10 vulnerability or
risk types for mobile devices are the following and no one is improper.
Platform usage, then insecure data storage.
Next is insecure communication, then insecure authentication.
Next is insufficient cryptography.
And this is actually one of the challenges nowadays because a lot of people are trying to create their
own crypto implementation.
OK, so whenever you do that and you don't reuse some of the stronger out there, like open SSL and
some other ones that actually a lot more maintainers actually contribute to them, you will introduce
security problems for sure.
Right.
So the other ones, it's not only as far as the actual core crypto components, but also the implementations
of those.
Right.
So especially whenever you actually do not have a sufficient cryptography, best practices, including
to your device.
Right.
Next is insecure authorization.
Another one is Glencora quality code tampering, reverse engineering and extraneous functionality as
well.
Now this change from time to time.
OK, so I definitely recommend for you to do two things.
Keep these resources handy and also subscribe to their mailing list to get information about any new
types.
And maybe you can even contribute to the project personally.
And these guys actually not only provide a lot of resources for mobile device security, but a lot of
resources and tools are also shared on their website.