How to Protect Mobile Applications from Risks Identified in the OWASP Mobile Top 10 and MASVS

As you may know, the OWASP Mobile Security Project is an output of the the Open Web Application Security Project. OWASP is best known for publicizing reliable content about emerging vulnerabilities in the web application space. The OWASP Mobile Security Project, or MSP for short, formalizes security requirements and best practices within the mobile application domain. 

In this blog post, I’ll explain why runtime application self-protection (RASP) and code hardening are both necessary to defend against key security risks outlined in the OWASP “Mobile Top 10” and Mobile Application Security Verification Standard (MASVS).

I’ll share my perspective on the significance of OWASP as a community, the OWASP Mobile Security Project and the OWASP “Mobile Top 10” and MASVS. I  also offer context into how RASP and code hardening specifically remediate each of the vulnerabilities they map to, in accordance with OWASP documentation, to enforce industry best practices and fortify the security posture of mobile applications and SDKs.

Why the OWASP Mobile Security Project Matters

The internet is saturated with conflicting information when it comes to mobile security. This makes it challenging, even for security professionals,  to find reliable information. The OWASP Mobile Security Project—specifically the “Mobile Top 10” and “MASVS”—provide reliable frameworks that can act as vital resources when identifying and remediating mobile application vulnerabilities.

What are the OWASP “Mobile Top 10” and MASVS?

The OWASP "Mobile Top 10" is a succinct list of the most commonly found risks in the mobile application environment. Many of these security risks arise from a lack of understanding or difficulty implementing; security best practices. The OWASP "Mobile Top 10" serves as an excellent blueprint for developers who want to prioritize security within their mobile application environment but are unsure of where to begin.

To view a full copy of the OWASP “Mobile Top 10”, click here. The MASVS is available here.

So what is the difference between the two?

The Mobile Top 10 can be thought of as the tip of the iceberg. It’s a list of the top 10 categories of security risks that are recommended to prioritize first when approaching mobile application security. In other words, it’s a good starting point for mobile app security, but there’s a bigger picture to be aware of as well.

The Mobile Application Security Verification Standard, or MASVS, can be thought of as “the rest of the iceberg.” The MASVS is a more complete list of other security risks found in the mobile application space that don’t fall into the "Mobile Top 10." Many, if not all, identified risks are a byproduct of coding that doesn’t adhere to security best practices. The MASVS seeks to highlight these gaps and provide dependable mitigations for the risks they bring about. 

One of the best ways to protect against several major risks covered by the Mobile Top 10 and MASVS is to implement a combination of runtime application self-protection (RASP) and code hardening, as we’ll explain in more detail below.

First, let’s go over some definitions quickly.

How Runtime Application Self-Protection Protects Mobile Apps

Mobile applications represent a large and rapidly growing attack surface. The tools and techniques used to compromise these environments are constantly evolving. Dynamic attacks allow adversaries the ability to enumerate more and exploit applications faster. These exploits can have a hugely negative impact on affected organizations – as well as mobile app end-users.

Runtime application self protection (RASP); is security strategy that makes use of runtime instrumentation to provide advanced detection of real-time indicators of threat and compromise. It does this by taking advantage of information from inside the running application. RASP can provide detection for jailbreaking, rooting, hooking and code tampering, in addition to obstruction for debugger and emulator attachments. In other words, RASP provides runtime detection for attacks.

Not all RASP solutions are created equally, however, so it is very important to understand the must-have features you are looking for. Top vendors offer RASP libraries that help prevent a huge array of dynamic attack vectors by providing both detection and obstruction for indicators of threat, including:

• hooking

• jailbreaking

• rooting

• code tampering

• debugger and emulator attachments of all types

The protection enabled by RASP ensures dynamic (online) attacks remain infeasible for attackers. It also  prevents them from gathering information about the functioning of applications, diminishing their ability to stage more sophisticated attacks.

How Code Hardening Protects Mobile Apps

Unprotected Android and iOS applications and SDKs can be reverse engineered with trivial effort using readily available disassemblers and/or decompilers. Using these tools, attackers can access and analyze the source code of mobile applications.

This allows for a broad range of abuse, including:

• theft of valuable code

• cloning of your applications

• extraction of sensitive information such as API keys and credentials

• adding malicious code to applications and repackaging them

Code hardening is a broad category that includes several strategies to defend against these types of attacks. Code hardening is an effective way of protecting both Android and iOS mobile apps against reverse engineering and hacking.

Code hardening means strengthening and protecting mobile application code at several levels using multiple layers of obfuscation and encryption. Hardened code is resistant to both automated and manual analysis.

How RASP and Code Hardening Map to the “Mobile Top 10” MASVS

Sophisticated mobile application security providers like Guardsquare can help defend against three of the security risks published in the OWASP "Mobile Top 10":

• Insecure Communications (M3)

• Reverse Engineering (M8)

• Code Tampering (M9)

Guardsquare also helps organizations protect against additional insecurities highlighted in the MASVS using a combination of RASP and code hardening. 

Let’s take a look at how this works in more detail.

Mapping Code Hardening to the "Mobile Top 10"

The table below maps code hardening solutions to the "Mobile Top 10" by showing which security risks the software can help defend against. A description of how the software maps to each security risk found in the OWASP "Mobile Top 10" is included.

Mapping RASP to the "Mobile Top 10"

The table provided below maps RASP solutions to the "Mobile Top 10” by showing which security risks the software helps defend against.  Also included is a description of how the software maps to each security risk found in the OWASP "Mobile Top 10.”

On the Build vs. Buy Question for Mobile App Security

Many development teams think they have what it takes to implement detection for dynamic attacks and protection against reverse engineering  because there is information available on the topic online. However, most teams are not prepared to build and implement a DIY solution capable of ensuring complete security for mobile apps. 

While many teams do have the skills and experience necessary to fix Mobile Top 10 findings M1-M7 and M10, most do not have the specialized experience and know-how needed to defend against OWASP Mobile Top 10 security risks M8 and M9 (Code Tampering and Reverse Engineering). That’s where a best-in-class application security solution can both simplify the path to building a secure application and save teams money. 

Not sure it will save money? In a cost-benefit analysis, being proactive about mobile app security is the most cost-effective strategy. Ask anyone who has “recovered” from a major breach. It’s expensive. The average cost per data breach globally is nearly $4 million. In the U.S., that figure doubles to $8 million—again, per incident. 

For the level of protection and knowledge achieved when investing in a strong RASP and code hardening solution, the ROI is clear. The investment may run into the tens of thousands of dollars, but it will never touch the $4 million cost of the average data breach.

In summary, only a thoughtful and complete combination of RASP and code hardening is sufficient to secure mobile apps against the full range of attacks outlined in OWASP’s Mobile Top 10 and MASVS. In the majority of cases, it’s best to buy rather than build, and to choose a sophisticated and reliable provider of layered app security. This approach is the best way to ensure apps are fully protected against the wide range of ever-changing attacks.