3 Strategies to Alleviate the Mobile App Security Talent Shortage

The cybersecurity talent shortage is real. In the US alone, cybersecurity demand is twice as great as the supply of available talent. Globally, open security roles surpassed 4 million in late 2019. When it comes to mobile app security, many organizations lack the staffing they need to protect these valuable assets. Cutting corners on mobile app security can lead to sensitive data loss, noncompliance, financial and reputational damages, exposure of infrastructure, and more.

What do you do if you don’t have people in-house to address mobile app security? Here are three ways to alleviate some of the issues related to cybersecurity talent shortages. 

Train your existing developers in secure coding

Not every developer intuitively thinks about security at each step of the development lifecycle. However, the ones that bake security into their processes can proactively protect their mobile applications from negative consequences. Many attackers look for vulnerabilities within the code of published applications. They’re constantly trying to identify ways to reverse-engineer or otherwise tamper with vulnerable applications. 

If developers have secure coding knowledge, they are able to make their applications more challenging targets. However, according to Synposis, none of the top five international schools for computer science require students to complete secure coding or secure application design courses as part of their graduation requirements. To alleviate this challenge, organizations should invest in on-the-job secure coding training. There are many publicly available resources and best practices for teams to use as well, including Carnegie Mellon’s CERT’s secure coding standards.

Leverage third-party security services as needed

The gig economy provides short-staffed organizations with the on-demand talent they need to extend their teams. Whether companies rely on a trusted contractor or vendor, these services can be crucial in the face of a talent crunch. Outsourced talent can supplement for skills gaps within your current mobile app development team or help them more effectively implement secure coding.

For example, third-party Red Teaming can help organizations understand how a mobile application attack could occur. Red Teams use penetration testing and other methods to simulate an adversarial attack against an application or its environment. These simulated attacks shed light on the most vulnerable parts of the application. From there, app development teams can address any potential vulnerabilities and issue the necessary patches or updates.

Lean on automation and security tools where possible

While automation isn’t the answer to everything, it can certainly help understaffed teams make the most of their existing skills. Paired with secure coding knowledge, certain tools can reduce the amount of manual work needed to protect mobile apps. Solutions like CircleCI and GitLab can help teams automate the development process and implement a secure software development lifecycle (SSDLC).

Application hardening is another area where specialized security solutions can help. Tools from organizations like Guardsquare can help teams apply a combination of code hardening techniques and protections at runtime. Code hardening is an effective way of protecting your APKs and SDKs for Android and iOS from reverse engineering and hacking. Hardened code is resistant to both automated and manual analysis, meaning that most of the tools attackers use are ineffective.