As Nigeria joins the rest of the world to mark October Cybersecurity Awareness Month, a cybersecurity expert and Chief Technology Officer of CED Technologies, Mr. Chukwuebuka Ume-Ezeoke, has highlighted five tips for secure mobile app development
The five tips, according to Chukwuebuka a highly Qualified Security Expert with expertise in fixing security vulnerabilities using an Automated Security Testing suite in minutes from Phishing and Social engineering attacks, will help Developers, Security Researchers, and Enterprises to build safe and secure applications.
The five tips are
Write a secure code
Bugs and vulnerabilities in a code are the starting point most attackers use to break into an application. They will try to reverse engineer your code and tamper with it. Keep the security of your code in mind from the day one and harden your code, making it tough to break through. Obfuscate and minify your code so it cannot be reverse engineered. Test repeatedly and fix bugs as and when they are exposed. Design your code so it is easy to update and patch. Make sure you keep your code agile so it can be updated at the user end post a breach. Use code hardening and code signing.
Encrypt all data
Every single unit of data that is exchanged over your app must be encrypted. Encryption is the way of scrambling plain text until it is just a vague alphabet soup with no meaning to anyone except those who have the key. You can understand the power of encryption when organizations like FB1 and NSA are found asking for permission to access iPhones and decode WhatsApp sages. If they can’t break through willfully, hacker sure can’t.
Be cautious with the libraries
When using third-parry libraries, be doubly careful and test the code thoroughly before using it in your app. As useful as they are, some libraries can be extremely insecure for your app. The GNU C Library, for instance, had a security flaw that could allow attackers to remotely execute malicious code and crash a system. And this vulnerability went undiscovered for over seven years. Developers should use controlled internal repositories and exercise policy controls during acquisition to protect their apps from vulnerabilities in libraries.
Use authorized APIs only
APIs that aren’t authorized and are loosely coded can unintentionally grant a hacker privileges that can be misused gravely. For example, caching authorization information locally helps programmers easily reuse that information when making API calls. Also, it makes coders’ life easier by making it easier to use the APls. However, it also gives attackers a loophole through which they can hijack privileges. Experts recommend that APIs be authorized centrally for maximum security.
Use high level authentication
In the wake of the fact that the some of the biggest security breaches happen due to weak authentication, it is becoming increasingly important to use stronger authentication. You can design your apps to only accept strong alphanumeric passwords that must be renewed every three or six months. Multi-factor authentication is gaining prominence, which involves a combination of static password and dynamic OTP. In case of overly sensitive apps, biometric uchentication like retina scan and fingerprints can be used too.