The Ultimate Security Checklist Before Launching Your Android App
2 likes2,540 views
The document provides a comprehensive checklist of 21 essential security measures to implement before launching an Android app. Key recommendations include using the Android application sandbox, minimizing permissions requests, performing strong input validation, and ensuring encrypted communication between clients and servers. It emphasizes the importance of securing application data, user privacy, and backend APIs to protect against potential threats.
The Ultimate Security Checklist Before Launching Your Android App
- 1. The Ultimate Security Checklist Before Launching Your Android App Enterprise Grade Mobile Security
- 2. Use the Android Application Sandbox, which isolates your app data and code execution from other apps. 1. Enterprise Grade Mobile Security
- 3. Use an encrypted filesystem that can be enabled to protect data on lost or stolen devices. 2. Enterprise Grade Mobile Security
- 4. Ensure that the registration and activation process is robust. 3. Enterprise Grade Mobile Security
- 5. Minimize the number of permissions that your app requests. 4. Enterprise Grade Mobile Security
- 6. Have application-defined permissions to control application data on a per- app basis. 5. Enterprise Grade Mobile Security
- 7. Have user-granted permissions to restrict access to system features and user data. 6. Enterprise Grade Mobile Security
- 8. Do not store sensitive information on external storage, such as SD Cards. These are globally readable and writable. 7. Enterprise Grade Mobile Security
- 9. Apply caution using network transactions because it involves transmitting data that is potentially private to the user. 8. Enterprise Grade Mobile Security
- 10. Perform strong input validations. Insufficient input validation is a common security problem affecting applications, regardless of the platform they run on. 9. Enterprise Grade Mobile Security
- 11. Native code that gets received over the network or from an IPC is vulnerable to threat. You can prevent it by careful handling pointers & managing buffers. 10. Enterprise Grade Mobile Security
- 12. If you are using data within queries that are submitted to an SQL database or a content provider, SQL injection may be an issue. The best defense is to use parameterized queries. 11. Enterprise Grade Mobile Security
- 13. Apply caution in using WebView because it consumes web content like HTML & JavaScript - improper use leads to web security issues such as cross-site-scripting (JavaScript injection). 12. Enterprise Grade Mobile Security
- 14. Minimize the frequency of asking for user credentials—it makes phishing attacks more conspicuous, and less likely to be successful. Instead use an authorization token and refresh it. 13. Enterprise Grade Mobile Security
- 15. Android provides algorithms for protecting data using cryptography such as supporting full- filesystem encryption & providing secure communication channels. 14. Enterprise Grade Mobile Security
- 16. A few apps implement IPC using traditional Linux techniques such as network sockets and shared files. Use Android system functionality for IPC such as Intent, Binder or Messenger with a Service, and BroadcastReceiver. 15. Enterprise Grade Mobile Security
- 17. Intents are the preferred mechanism for asynchronous IPC in Android. Depending on your application requirements, you might use sendBroadcast(), sendOrderedBroadcast(), or an explicit intent to a specific application component. 16. Enterprise Grade Mobile Security
- 18. Using Binder or Messenger is the preferred mechanism for RPC-style IPC in Android. They provide a well-defined interface that enables mutual authentication of the endpoints, if required. 17. Enterprise Grade Mobile Security
- 19. Do not load code from outside of your application APK. It significantly increases the likelihood of application compromise due to code injection or code tampering. 18. Enterprise Grade Mobile Security
- 20. Maintain security of the backend APIs (services) and the platform (server). 19. Enterprise Grade Mobile Security
- 21. Ensure secure distribution and provisioning of mobile applications. 20. Enterprise Grade Mobile Security
- 22. Use encrypted communications between clients and servers through properly configured SSL. 21. Enterprise Grade Mobile Security
- 23. CONCLUSION Here you go with the 21 most essential checks that you should perform before launching your Android App. Even if you already have, it would be a good revisit. Enterprise Grade Mobile Security
- 24. REGISTER FOR A FREE SECURITY SCAN Appknox helps you unlock the security issues in your mobile app & suggests immediate action! Register Now! Enterprise Grade Mobile Security