December 8, 2016 By Larry Loeb 2 min read

App Transport Security (ATS) is a method Apple uses to describe an app’s network security posture. It takes many factors and elements into account, such as HTTPS, Transport Layer Security (TLS), Perfect Forward Secrecy (PFS) and Certificate Transparency.

Apple stated several times at this year’s World Wide Developer’s Conference that it would enforce compliance with this standard at the beginning of 2017, even though it had been enabled by default since the days of iOS 9. The company also plans to begin reviewing non-ATS apps in its official App Store.

Companies Not Ready for App Transport Security

However, security firm Appthority conducted an analysis of the top 200 iOS apps found on enterprise devices and found that the industry has a long, long way to go when it comes to full compliance with ATS.

According to the study, 97 percent of the apps examined had used an exception in operation or other, less restrictive settings that could weaken the default ATS configuration. Additionally, 57 percent do not use ATS in any way, shape or form.

The idea behind ATS was to make apps communicate over the internet using encrypted HTTPS connections. Apple also wanted to force the use of strong encryption protocols and ciphers that had no known weaknesses. By providing the development community with the software to create these HTTPS connections, the tech giant hoped to avoid configuration errors that had routinely occurred with third-party solutions.

Apple’s Pipe Dream for 2017

HTTPS use has long been a sticking point for many popular apps. CSO Online reported that major apps such as Facebook, Facebook Messenger, Twitter, LinkedIn, Skype, Netflix, ESPN and more all use non-HTTPS communication.

These companies may have their reasons for putting off ATS. Apps talk not only to their own servers, but also to third-party advertising, market research, analytics and file hosting services. These external services may not allow HTTPS connections, but the program still needs to be able to communicate with them.

It seems that full ATS compliance by enterprise-worthy apps will not happen by the start of 2017. What Apple will do in response to this noncompliance remains to be seen.

More from

CVE-2023-20078 technical analysis: Identifying and triggering a command injection vulnerability in Cisco IP phones

7 min read - CVE-2023-20078 catalogs an unauthenticated command injection vulnerability in the web-based management interface of Cisco 6800, 7800, and 8800 Series IP Phones with Multiplatform Firmware installed; however, limited technical analysis is publicly available. This article presents my findings while researching this vulnerability. In the end, the reader should be equipped with the information necessary to understand and trigger this vulnerability.Vulnerability detailsThe following Cisco Security Advisory (Cisco IP Phone 6800, 7800, and 8800 Series Web UI Vulnerabilities - Cisco) details CVE-2023-20078 and…

X-Force data reveals top spam trends, campaigns and senior superlatives in 2023

10 min read - The 2024 IBM X-Force Threat Intelligence Index revealed attackers continued to pivot to evade detection to deliver their malware in 2023. The good news? Security improvements, such as Microsoft blocking macro execution by default starting in 2022 and OneNote embedded files with potentially dangerous extensions by mid-2023, have changed the threat landscape for the better. Improved endpoint detection also likely forced attackers to shift away from other techniques prominent in 2022, such as using disk image files (e.g. ISO) and…

The compelling need for cloud-native data protection

4 min read - Cloud environments were frequent targets for cyber attackers in 2023. Eighty-two percent of breaches that involved data stored in the cloud were in public, private or multi-cloud environments. Attackers gained the most access to multi-cloud environments, with 39% of breaches spanning multi-cloud environments because of the more complicated security issues. The cost of these cloud breaches totaled $4.75 million, higher than the average cost of $4.45 million for all data breaches.The reason for this high cost is not only the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today