Cloud 101
Circle
Events
Blog

Download Publication

Mobile Application Security Testing
Mobile Application Security Testing

Mobile Application Security Testing

Release Date: 06/30/2016

The Mobile Application Security Testing (MAST) Initiative is a research which aims to help organizations and individuals reduce the possible risk exposures and security threat in using mobile applications. MAST aims define a framework for secure mobile application development, achieving privacy and security by design. Implementation of MAST will result in clearly articulated recommendations and best practices in the use of mobile applications.

Mobile application security testing and vetting processes utilized through MAST involve both static and dynamic analyses to evaluate security vulnerabilities of mobile applications for platforms such as Android, iOS and Windows. These processes cover permissions, exposed communications, potentially dangerous functionality, application collusion, obfuscation, excessive power consumption and traditional software vulnerabilities. It also covers internal communications such as debug flag and activities and external communications such as GPS, NFC access as well as checking the links that are written in the source code. In addition to security testing and vetting, the initiative has also proposed processes and procedures for security incidence response.

The use of mobile applications has become unavoidable, almost a necessity, in today's world. More people are starting to question the security of mobile applications and it's about time that you take a look at what the Cloud Security Alliance has to say about mobile application security!

Download this Resource

Prefer to access this resource without an account? Download it now.

Acknowledgements

John Yeoh Headshot
John Yeoh
Global Vice President of Research, CSA

John Yeoh

Global Vice President of Research, CSA

With over 15 years of experience in research and technology, John excels at executive-level leadership, relationship management, and strategy development. He is a published author, technologist, and researcher with areas of expertise in cybersecurity, cloud computing, information security, and next generation technology (IoT, Big Data, SecaaS, Quantum). John specializes in risk management, third party assessment, GRC, data protection, incid...

Read more

​Aaron Guzman Headshot
​Aaron Guzman

​Aaron Guzman

Aaron is a passionate information security professional specializing in IoT, embedded, and automotive security. He is co-author of the “IoT Penetration Testing Cookbook” and a technical editor for the "Practical Internet of Things Security” Packt Publishing books. Aaron is co-chair of CSA’s IoT working group as well as a leader for OWASP’s IoT and Embedded Application Security projects; providing practical guidance to address the most commo...

Read more

Edward Chiu Headshot
Edward Chiu
Cybersecurity, Chevron IT Company

Edward Chiu

Cybersecurity, Chevron IT Company

Edward is a Distinguished Engineer in Cybersecurity at Chevron Technical Center. He serves in CSA's Quantum-Safe Security working group, during which time he authored “Preparing Enterprises for the Quantum Computing Cybersecurity Threats,” and co-authored “A Day Without Safe Cryptography.” His experience includes cybersecurity R&D and operations, ...

Read more

Mickey Law Headshot Missing
Mickey Law

Mickey Law

This person does not have a biography listed with CSA.

Srinivas Naik Headshot Missing
Srinivas Naik

Srinivas Naik

This person does not have a biography listed with CSA.

Setumadhav Kulkarni Headshot Missing
Setumadhav Kulkarni

Setumadhav Kulkarni

This person does not have a biography listed with CSA.

Lynne Yang Headshot Missing
Lynne Yang

Lynne Yang

This person does not have a biography listed with CSA.

Curtis Kozielec Headshot Missing
Curtis Kozielec

Curtis Kozielec

This person does not have a biography listed with CSA.

Timothy G. O’Brien Headshot Missing
Timothy G. O’Brien

Timothy G. O’Brien

This person does not have a biography listed with CSA.

Douglas Lee Headshot Missing
Douglas Lee

Douglas Lee

This person does not have a biography listed with CSA.

Eric Wang Headshot
Eric Wang

Eric Wang

Mr. Wang has more than 30 years experience in IT domain, he the expert on IT Security, and also professional in ERP, and Linux. He had led may important IT projects, such as emoffice、MEES、ecOS, iBon v1, Jcloud, and Bootable-USB-EasyLock. He is also UWCE/UWSE Implementor、ISO/IEC 17025 Certification、CEH, AutoCad certified, as well as the e-commerce representer in APEC 2009.

Right now, Eric Wang leads CSA “Mobile App Security Testing (MA...

Read more

Dong Ji Headshot Missing
Dong Ji

Dong Ji

This person does not have a biography listed with CSA.

Keng Lee Headshot Missing
Keng Lee

Keng Lee

This person does not have a biography listed with CSA.

Zhan Leilei Headshot Missing
Zhan Leilei

Zhan Leilei

This person does not have a biography listed with CSA.

Yin Liping Headshot Missing
Yin Liping

Yin Liping

This person does not have a biography listed with CSA.

Dean McBride Headshot Missing
Dean McBride

Dean McBride

This person does not have a biography listed with CSA.

Porus Mehta Headshot Missing
Porus Mehta

Porus Mehta

This person does not have a biography listed with CSA.

Mark Perry Headshot Missing
Mark Perry

Mark Perry

This person does not have a biography listed with CSA.

Jim Pinter Headshot Missing
Jim Pinter

Jim Pinter

This person does not have a biography listed with CSA.

VijayVK Velu Headshot Missing
VijayVK Velu

VijayVK Velu

This person does not have a biography listed with CSA.

Matt Wehnes Headshot Missing
Matt Wehnes

Matt Wehnes

This person does not have a biography listed with CSA.

Timothy Grance Headshot Missing
Timothy Grance

Timothy Grance

This person does not have a biography listed with CSA.

Stephen Quirolgico Headshot Missing
Stephen Quirolgico

Stephen Quirolgico

This person does not have a biography listed with CSA.

Are you a research volunteer? Request to have your profile displayed on the website here.