Mobile applications have revolutionized the way we consume information. Nowadays, most organizations leverage these powerful tools to enhance their employees’ agility with services that are available 24/7. But granting applications access to highly sensitive corporate data also widens the mobile attack surface, which is why it’s crucial to not overlook the associated application security threats.

Mobile Apps Complicate the Data Privacy Picture

A mobile application is like an iceberg; most of its behaviors are executed silently. On one hand, it can be inherently malicious and feature malware that, when hosted on a device, targets the user’s data, credentials, transactions and more. These behaviors are mostly found in applications available on third-party stores, but sometimes also in major commercial app stores. In 2019, Pradeo Lab discovered that 5 percent of Android and 2 percent of iOS apps hosted malicious programs.

On the other hand, a mobile application doesn’t need to be malicious to hurt collaborators’ privacy. Greyware is a category of application that comprises intrusive apps that exfiltrate user data to the network (67 percent of Android apps and 61 percent of iOS apps) as well as vulnerable apps developed without following security best practices (61 percent of Android apps).

Either way, mobile apps have the power to severely compromise corporate data privacy. Today, security heads are stuck with the major challenge of complying with data privacy laws and enhancing user productivity while preserving their agility.

Shed Light on Mobile Application Security Threats in Your Network

Organizations that distribute mobile apps are encouraged — and required by law in some industries — to diagnose their security levels prior to release. To shed light on all aspects of a mobile app, it is necessary to audit it with a mobile application security testing (MAST) tool. MAST solutions perform multidimensional analyses (static and dynamic) that allow security teams to detect all app behaviors and vulnerabilities. This way, organizations can ensure that the apps they are about to release do not threaten the privacy of any corporate or personal data. If they do, this process will help the relevant parties repackage them.

MAST solutions are available as software-as-a-service (SaaS) and sometimes as an application programming interface (API) to integrate within developers’ environments. In addition, some unified endpoint management (UEM) solutions are starting to integrate this kind of service within their platform to facilitate security heads’ experience.

Register for the webinar to learn more

More from Application Security

Does Follina Mean It’s Time to Abandon Microsoft Office?

As a freelance writer, I spend most of my day working in Microsoft Word. Then, I send drafts to clients and companies across the globe. So, news of the newly discovered Microsoft Office vulnerability made me concerned about the possibility of accidentally spreading malware to my clients. I take extra precautions to ensure that I’m not introducing risk to my clients. Still, using Microsoft Office was something I did many times a day without a second thought. I brought up…

3 Reasons Why Technology Integration Matters

As John Donne once wrote, “No man is an island entire of itself.” With digitalization bridging any distance, the same logic could be applied to tech. Threat actors have vast underground forums for sharing their intelligence, while security professionals remain tight-lipped in a lot of data breach cases. Much like the way a vaccine can help stop the spread of infectious diseases, sharing threat intelligence and defense strategies can help to establish a more secure future for everyone.  So what…

Why Your Success Depends on Your IAM Capability

It’s truly universal: if you require your workforce, customers, patients, citizens, constituents, students, teachers… anyone, to register before digitally accessing information or buying goods or services, you are enabling that interaction with identity and access management (IAM). Many IAM vendors talk about how IAM solutions can be an enabler for productivity, about the return on investment (ROI) that can be achieved after successfully rolling out an identity strategy. They all talk about reduction in friction, improving users' perception of the…

Controlling the Source: Abusing Source Code Management Systems

For full details on this research, see the X-Force Red whitepaper “Controlling the Source: Abusing Source Code Management Systems”. This material is also being presented at Black Hat USA 2022. Source Code Management (SCM) systems play a vital role within organizations and have been an afterthought in terms of defenses compared to other critical enterprise systems such as Active Directory. SCM systems are used in the majority of organizations to manage source code and integrate with other systems within the…