08
Tue, Oct
2 New Articles

Taking Mobile Applications and Data Security Seriously

Development Tools / Utilities
Typography
  • Smaller Small Medium Big Bigger
  • Default Helvetica Segoe Georgia Times

Mobile applications need to be secured. It's not a question of "if" but "when" attacks will occur.

 

Today, many organizations are rushing to build mobile applications and mobile websites to gain a competitive advantage within their industry. The rate and speed at which applications are being pushed into the marketplace is phenomenal and is only increasing with the explosion of mobile devices. Traditional businesses have been forced to think outside of the box to leverage mobile devices in innovative and creative ways, partly from pressure by their competitors and their own employees with the growing trend of Bring Your Own Device (BYOD) to work.

 

Building traditional business applications versus building native mobile applications requires a change in a developer's mindset. Developers need to take into account how best to provide information to their end-users in real-time in order for business decisions to be made on the move from anywhere in world withoutcompromising security and access to the information.

 

While most organizations should be considering developing a mobile application, others are rushing to deliver applications quickly, on a limited budget with little internal resources, ultimately overlooking critical security considerations. Users are increasingly demanding secure mobile applications, and, understandably, organizations are hesitant because it usually means more time and money required to build secure mobile applications. However, there needs to be a happy medium to accommodate the very real security concerns of customers while still trying to gain a competitive advantage quickly for organizations.

 

To put mobile applications and data security in perspective, here are a few statistics that highlight the growing need for organizations to be mindful of security:

 

  • 85% of US companies have experienced one or more data breaches.1
  • Mobile malware increased by 250% over the last couple of years.2
  • 36% of mobile users do not have a password setup on their device.3
  • 30% of mobile users save their password in the notes apps on the phone.3
  • 70% of people have lost a smartphone or other device in the last 12 months.4
  • In 2012 – 264 mobile thefts were reported every day.4
  • 81% of US workers report at least one personal electronic device for business use.4
  • Mobile sales rose to 645 million devices by the end of 2012.5

 

From the statistics above, we can see that the security risks and challenges faced by organizations when building mobile applications are very real. Luckily, most of this can be avoided and overcome with some simple, proactive steps that can be taken by your development team, your IT department, and your end-users.

 

In this article, I will examine these challenges and outline solutions that will enable you to develop and deploy secure mobile applications quickly while ensuring user privacy and access to your critical business information are adequately protected.

 

 

Mobile Application Security can be broken down into following three main categories:

  • Securing Data at Rest on the Mobile Device
  • Securing Communication Between the Mobile Device and the Server
  • Securing   Application Access to the Data

Securing Data at Rest on the Mobile Device

With the ability of native applications on mobile devices to read/write files to the device operating system, it becomes extremely important to secure information so that only the intended application can access the information when end-users interact with the application. Luckily, both Android and Apple operating systems provide a sandbox environment for each application so that only that application can read/write data to the file system.

 

Applications should also encrypt the information on the file system using industry-standard encryption algorithms to further protect sensitive application data. Both Android and Apple also provide password, gesture, and pin access to the device that can be configured and set up so unauthorized use of applications and data on the device can be eliminated.

 

Mobile device manufacturers and operating system vendors in the marketplace today are increasingly being asked to provide additional security capabilities built into the operating system and software to conform to government regulations, identify malicious activity, detect viruses and spyware, as well as secure application data. Additionally, device manufacturers are now providing the ability to install business applications in a secure sandbox environment (dividing the mobile device into two parts so that the operating system separates corporate and personal data/applications) that can be integrated and controlled by the IT department in your organization.

 

When building applications for mobile devices and storing data on the device, it is important to consider and analyze the following key aspects:

  • Is the data being stored encrypted and compressed?
  • What is the lifespan of data stored on the device?
  • How sensitive is the information being stored? If very sensitive, should it be stored at all?
  • Has application access to the data been secured in some way, e.g., login user ID and password?
  • If the device is lost or stolen, can access to the application be immediately revoked and terminated?
  • If the device is lost or stolen, can the device be wiped remotely?
  • Is the data available for offline use? If yes, is the data erased and cleaned up by the application?

 

With the constant demand on business and IT to deliver "more with less," organizations can deliver real business value using a Mobile Application Framework and mitigate risk, thus providing businesses with real cost savings. When evaluating Mobile Application Frameworks for building native applications for Android and Apple devices, it is important to evaluate against the following criteria:

  • Is the mobile application framework from a reputable vendor?
  • Has the vendor been in business for a long time, and does the vendor have a proven track record?
  • Does the mobile application framework leverage existing developer skill sets?
  • Does the mobile application framework deliver the building blocks required for mobile applications: security model, navigation, user interface elements, examples?
  • Does the mobile application support both Android and Apple operating systems?

Securing  Communication Between the Mobile Device and the Server

Most applications connect to information being stored on the server using standard web protocol (HTTP) and pass data back and forth using standard data formats like XML or JSON. Using public Wi-Fi or cellular signal from anywhere in the world and connecting to data on the server can allow hackers to intercept and view information being transferred over the wire using sniffing tools and man-in-the-middle attacks. Since the World Wide Web is the number one source of information for most people these days, and the web uses the HTTP protocol to communicate between the web browser and server, it is easy to see why a connection can be easily intercepted and hacked.

 

One of the easiest ways to secure communication is to simply use HTTPs protocol instead of HTTP protocol when building business applications and accessing data on the server. Using SSL connection to the web server automatically means that the data is being encrypted with a digital certificate that can be set up and configured on the web server. Typically, digital certificates provide a minimum 128-bit encryption all the way up to 4096-bit encryption, which ensures the data being transmitted over the wire is secure and not available to hackers.

 

Using IBM i back-end as the server for building mobile applications provides many benefits. With the latest advancements in Cryptography and Digital Certificates built into the Apache Webserver and the IBM i OS to provide a reliable and proven platform, the IBM i platform has proven to be one of the most secure platforms to run your mission critical business applications.

Securing Application Access to Data

One of the challenges when building mobile applications is to make sure users are given access only to information that they are authorized to view and that sensitive data is never stored on the device itself. One of the keys to securing application access to corporate business data on your servers is to develop a solid framework that will handle all aspects of data security and access on the server.

 

Some common techniques that can ensure secure application access to data on the server are:

  • Set up role-based security to control user access and visibility to business data. This will allow you to easily manage and administer access and also turn "off" access to information on the server if required.
  • Do not store passwords or PINs on the device; always perform all application security checks on the server.
  • Encrypt all sensitive information on the server and send only the required amount of information to the mobile application.
  • Log all application activity on the server from all devices and restrict access to applications and data based on the unique device identifier.
  • Prompt for an additional PIN number to access critical paths of the server, and revalidate and verify the login information on subsequent requests after the initial login to the application has been verified.
  • Implement a firewall and DMZ (Demilitarized Zone) that contains your organization's external-facing servers to the outside world. This provides an additional later of security to an organization's network, applications, and data.
  • Provide VPN access for added security that can be easily enabled or disabled on the server side.
  • Leverage remote monitoring capabilities that provide the ability to remotely wipe a device if it gets lost or stolen.
  • Educate and manage employee behavior and usage of mobile applications in order to keep security intact. Provide employees with regular updates and make them aware of your security policies.

 

The IBM i platform hosts some of the biggest mission-critical business applications on the planet and has always had a built-in object-based and user-profile management system that is not only simple to set up and leverage, but also very powerful. Reducing the steps required to configure user profiles and manage access to your programs/files on the server, using the standard IBM i user profile security with authorization lists, makes the IBM i a compelling choice for businesses.

 

Even the most secure platform on the planet needs protection from threats and breaches when dealing with business data. The IBM i platform provides the necessary tools required to secure the infrastructure and access to the information, thereby helping business to lower risks and cost.

Summary: Mobile Application Development and Data Security

 

Application and data security has always been and will continue to be a cat-and-mouse game between the good guys and the bad guys. New threats and vulnerabilities are being found and exploited by the bad guys, while the good guys try to fix the vulnerabilities by putting in place appropriate measuresboth hardware and softwareto thwart the new-age cyber criminals.

 

The great news for all of us building mobile applications is that both software and hardware mobile ecosystems are not only evolving at a rapid pace, but also constantly being improved to support the latest in encryption and cryptography as well as making mobile device operating systems smarter in detecting and dealing with threats in real-time.

 

At the end of the day, mobile applications need to be secured. It's not a question of "if" but "when" attacks will occur. From an application-development perspective, it is important to understand and be mindful of security issues when building enterprise applications for mobile devices. Make sure that the checklist outlined below has been considered and implemented to the fullest extent possible so that multiple layers of application security exist to help reduce the surface area that the bad guys can exploit.

 

12-Point Mobile Application and Data Security Checklist

1

Update  your smartphone OS, irrespective of it being an Android or an Apple device, whenever any application patches or OS upgrades are released.

2

Always use a passcode to lock your device in order to avoid data leakage, especially if the device is being used by a stranger.

3

Do not jail-break, root, or modify the operating system files.

4

Regularly back up or synchronize your settings and other personal information in order to avoid the loss of data due to theft. For additional security, install device-tracking applications to find your device if it gets lost or stolen.

5

Learn about an application's reputation before installing it. Make sure the application vendor or developer is a trusted source, has been in business for a considerable amount of time, and has a solid reputation.

6

Always be careful when downloading applications or clicking URLs. Use only trusted application-makers to download applications and make sure you check an app' s review and ratings before you download it. Never click on unknown URLs or respond to requests for your personal information.

7

Make protecting your mobile device as much of a priority as protecting your PC. Scan for viruses and spyware regularly by installing antivirus or firewall software.

8

Be careful when using public Wi-Fi hot spots. Only "window shop." Do not make purchases, perform financial transactions, or provide personal information using public Wi-Fi hot spots.

9

When using a business application to access business data, make sure it has been approved by your IT department, and always use a secure connection. Optionally, use a VPN connection to the server and do not store sensitive data locally on the device unless it is encrypted and secured.

10

Work with your IT department to develop and implement a security policy regarding what content is allowed to be accessed on devices, how it will be accessed, and how the organization will handle access to business data and applications as well as lost or stolen devices.

11

Make sure your development team incorporates security into the entire application development lifecycle by identifying and prioritizing critical applications and testing for security and vulnerabilities. Make sure to retest when applications change to protect critical assets and information.

12

Stay flexible and be prepared to evolve and adapt to the changing mobile landscape by regularly evaluating your security policies to make sure they align with mobile reality by conducting frequent risk assessments.

 

With smartphone penetration now at 50% in the U.S., the explosion of mobile applications for business will continue to generate mass consumer appeal. In today's business environment, consumers want quick, easy access to business systems and the ability to communicate in real-time. Using the guidelines I've discussed above, businesses can accommodate the real security concerns of employees and customers while gaining a competitive advantage.

 

Sources

1 State of Application Securityhttp://www.business.att.com/content/other/att-security-applications-infographic.jpg

2 Juniper Networks Global Threat Centerhttp://blackberrysync.com/2011/08/the-cold-hard-facts-of-mobile-security-with-dos-and-donts/

3 McAfee Consumer Surveryhttps://blogs.mcafee.com/consumer/unprotected-mobile-devices

4 Mobile Security Factshttp://www.passban.com/2012/12/19/noteworthy-facts-involving-mobile-security/

5 Symantec Internet Security Reporthttp://www.symantec.com/content/en/us/enterprise/other_resources/b-istr_main_report_2011_21239364.en-us.pdf

 

 

Madan Divaker

Madan Divaker, Product Manager, LANSA
Since joining LANSA in 1997, Madan has acquired extensive knowledge in all LANSA products. His experience includes .NET, Java, Web, and mobile expertise. Initially, he worked at the LANSA Product Center in Sydney, Australia, helping design and develop the LANSA product suite, including LongRange for building intuitive mobile applications. Currently, Madan is involved with LANSA Training, Technical Support, Pre-sales, Services and Product Development, as well as keeping abreast of market and technology trends. He has also presented at numerous IBM Conferences and user groups on broad topics covering IBM i, mobility, Web development, and Application Architecture and Design and is an active member of the IBM ISV Advisory Council.

BLOG COMMENTS POWERED BY DISQUS

LATEST COMMENTS

Support MC Press Online

$

Book Reviews

Resource Center

  • SB Profound WC 5536 Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application. You can find Part 1 here. In Part 2 of our free Node.js Webinar Series, Brian May teaches you the different tooling options available for writing code, debugging, and using Git for version control. Brian will briefly discuss the different tools available, and demonstrate his preferred setup for Node development on IBM i or any platform. Attend this webinar to learn:

  • SB Profound WP 5539More than ever, there is a demand for IT to deliver innovation. Your IBM i has been an essential part of your business operations for years. However, your organization may struggle to maintain the current system and implement new projects. The thousands of customers we've worked with and surveyed state that expectations regarding the digital footprint and vision of the company are not aligned with the current IT environment.

  • SB HelpSystems ROBOT Generic IBM announced the E1080 servers using the latest Power10 processor in September 2021. The most powerful processor from IBM to date, Power10 is designed to handle the demands of doing business in today’s high-tech atmosphere, including running cloud applications, supporting big data, and managing AI workloads. But what does Power10 mean for your data center? In this recorded webinar, IBMers Dan Sundt and Dylan Boday join IBM Power Champion Tom Huntington for a discussion on why Power10 technology is the right strategic investment if you run IBM i, AIX, or Linux. In this action-packed hour, Tom will share trends from the IBM i and AIX user communities while Dan and Dylan dive into the tech specs for key hardware, including:

  • Magic MarkTRY the one package that solves all your document design and printing challenges on all your platforms. Produce bar code labels, electronic forms, ad hoc reports, and RFID tags – without programming! MarkMagic is the only document design and print solution that combines report writing, WYSIWYG label and forms design, and conditional printing in one integrated product. Make sure your data survives when catastrophe hits. Request your trial now!  Request Now.

  • SB HelpSystems ROBOT GenericForms of ransomware has been around for over 30 years, and with more and more organizations suffering attacks each year, it continues to endure. What has made ransomware such a durable threat and what is the best way to combat it? In order to prevent ransomware, organizations must first understand how it works.

  • SB HelpSystems ROBOT GenericIT security is a top priority for businesses around the world, but most IBM i pros don’t know where to begin—and most cybersecurity experts don’t know IBM i. In this session, Robin Tatam explores the business impact of lax IBM i security, the top vulnerabilities putting IBM i at risk, and the steps you can take to protect your organization. If you’re looking to avoid unexpected downtime or corrupted data, you don’t want to miss this session.

  • SB HelpSystems ROBOT GenericCan you trust all of your users all of the time? A typical end user receives 16 malicious emails each month, but only 17 percent of these phishing campaigns are reported to IT. Once an attack is underway, most organizations won’t discover the breach until six months later. A staggering amount of damage can occur in that time. Despite these risks, 93 percent of organizations are leaving their IBM i systems vulnerable to cybercrime. In this on-demand webinar, IBM i security experts Robin Tatam and Sandi Moore will reveal:

  • FORTRA Disaster protection is vital to every business. Yet, it often consists of patched together procedures that are prone to error. From automatic backups to data encryption to media management, Robot automates the routine (yet often complex) tasks of iSeries backup and recovery, saving you time and money and making the process safer and more reliable. Automate your backups with the Robot Backup and Recovery Solution. Key features include:

  • FORTRAManaging messages on your IBM i can be more than a full-time job if you have to do it manually. Messages need a response and resources must be monitored—often over multiple systems and across platforms. How can you be sure you won’t miss important system events? Automate your message center with the Robot Message Management Solution. Key features include:

  • FORTRAThe thought of printing, distributing, and storing iSeries reports manually may reduce you to tears. Paper and labor costs associated with report generation can spiral out of control. Mountains of paper threaten to swamp your files. Robot automates report bursting, distribution, bundling, and archiving, and offers secure, selective online report viewing. Manage your reports with the Robot Report Management Solution. Key features include:

  • FORTRAFor over 30 years, Robot has been a leader in systems management for IBM i. With batch job creation and scheduling at its core, the Robot Job Scheduling Solution reduces the opportunity for human error and helps you maintain service levels, automating even the biggest, most complex runbooks. Manage your job schedule with the Robot Job Scheduling Solution. Key features include:

  • LANSA Business users want new applications now. Market and regulatory pressures require faster application updates and delivery into production. Your IBM i developers may be approaching retirement, and you see no sure way to fill their positions with experienced developers. In addition, you may be caught between maintaining your existing applications and the uncertainty of moving to something new.

  • LANSAWhen it comes to creating your business applications, there are hundreds of coding platforms and programming languages to choose from. These options range from very complex traditional programming languages to Low-Code platforms where sometimes no traditional coding experience is needed. Download our whitepaper, The Power of Writing Code in a Low-Code Solution, and:

  • LANSASupply Chain is becoming increasingly complex and unpredictable. From raw materials for manufacturing to food supply chains, the journey from source to production to delivery to consumers is marred with inefficiencies, manual processes, shortages, recalls, counterfeits, and scandals. In this webinar, we discuss how:

  • The MC Resource Centers bring you the widest selection of white papers, trial software, and on-demand webcasts for you to choose from. >> Review the list of White Papers, Trial Software or On-Demand Webcast at the MC Press Resource Center. >> Add the items to yru Cart and complet he checkout process and submit

  • Profound Logic Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application.

  • SB Profound WC 5536Join us for this hour-long webcast that will explore:

  • Fortra IT managers hoping to find new IBM i talent are discovering that the pool of experienced RPG programmers and operators or administrators with intimate knowledge of the operating system and the applications that run on it is small. This begs the question: How will you manage the platform that supports such a big part of your business? This guide offers strategies and software suggestions to help you plan IT staffing and resources and smooth the transition after your AS/400 talent retires. Read on to learn: