Mobile DevSecOps: 5 Tips from Building Mobile Apps Used by Millions
summary
Claims that tested apps used by 50 million and that mobile testing runs at scale with 3–5k pen tests/day. Shows concrete failures: hostname validation missing, HTTP traffic, secrets on SD cards or keychain, excessive third‑party libs and deep‑link exploits leaking PII. Demonstrates automation: insert dynamic tests after the Jenkins binary build, run 15 minutes on a real device (not emulators), cloud device‑farm or on‑prem options, and a case that moves from manual to fully automated security in about twelve months.
AI-written summary · about
chapters (11)
- 0:00Start
- 6:35Scalability
- 6:50The Differences in Mobile and Web
- 12:22Dynamic Testing
- 14:31Insufficient Security and Privacy Restrictions
- 14:55Network Connections
- 15:05Device Considerations
- 23:46Dynamic Testing for Mobile Is Actually Better than Static
- 24:18Build It into the Requirements
- 27:55Remote Code Execution
- 31:54Seeing any Differences between Progressive Web Apps and Native Apps
related talks
30mMobile DevSecOps 5 Tips from Building Mobile Apps Used by Millions
33mBest Practices for Mobile App Security Testing
48mHow to Meet the New Mobile Application Security Imperative
32mHack Your Own App: Getting Started with Mobile Penetration Testing
20mMobile Application Security (MAS)
01h 13mAutomated Static And Dynamic Security Analysis of Mobile Apps
52mMobile Application Assessments By The Numbers: A Whole-istic View
45mTen Secrets to Secure Mobile Applications