Mobile applications have developed into one of the most popular trends in the technology sector. However, this has come at a huge price. The quick rise in acceptance equates to businesses rushing applications to the market without extensive security testing. Unfortunately the developers and app stores do not test applications prior to release. Therefore, a number of security issues have emerged, especially for those connecting to a corporate network.
The source of this growing problem is the failure of developers to make security a process not an added feature. Mobile device security can be divided into four sections which combine to become a “Security Stack.” Essentially the top layers of security rely solely on the bottom layers to function correctly and thus protect the user and their information. These four security layers include:
- Infrastructure Layer
- Hardware Layer
- Operating System Layer
- Application Layer
The infrastructure layer is at the bottom of the Security Stack and is directly managed by the mobile carrier. This section also provides integration between the infrastructure and handset. The Hardware Layer is the equipment associated with the operation of the system and direct access to the infrastructure layer. This section is also known as firmware, can be upgraded and is operated by the device’s manufacturer.
The next highest segment is the Operating System Layer which works with the hardware and applications. This area is also upgraded and managed by the device manufacturer. The Operating System Layer is typically targeted by cyber criminals. Finally, the Application Layer contains all programs utilized by users; therefore, it is comprised of every entity running on the operating system. Device manufacturers and users have the ability to install applications.
To successfully develop a secure mobile application, it is important to be able to identify the threats. Once you discover what these threats are, you will be able to prevent them immediately from the planning stage and should continue through regular maintenance and involve all groups involved in development.
Most individuals believe information on mobile phones is safe because it is such a new technology. However, with the growing usage of mobile device applications that reveal sensitive data, attackers are learning how to extract that information and wreak havoc on mobile systems. As a result, application developers must be more cognizant to the potential threats involved with these small programs and do everything in their power to eliminate them.
