Insiders Guide to Mobile AppSec with Latest OWASP MASVS
summary
Claims a vendor pen tested thousands of apps and scanned millions and finds concrete failure rates not platitudes 50% insecure data storage 48% use HTTP not HTTPS and need cert pinning about a third exposed to reverse engineering so use obfuscation and tamper checks MASVS gives L1/L2 tiers and eight domains, MSTG maps to tests, tooling recommendations include Frida and radare and a Cyclone DX SBOM, and NowSecure offers reports and automation to verify fixes.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 5:50What is MASVS
- 12:31Data Storage
- 14:42Network Calls
- 16:35Insecure Authentication
- 18:48Insecure Coding
- 20:36Reverse Engineering
- 24:24Cyclone DX
- 26:16Further Learning
related talks
30mTopics of Interest: Creating an IoT-connected Mobile App Compliance Program... MASVS
21mSecuring Mobile Apps with OWASP MASVS & MSTG
29mFixing Mobile AppSec
28mOWASP Mobile Application Security (MAS)
44mHow the latest MASVS & MSTG Specs Make the Best Mobile Pen Testing Cocktails
20mMobile Application Security (MAS)
45mFast Forwarding Mobile Security With The OWASP Mobile Security Testing Guide
16mBe Aware & Prepare- Independent Security Reviews Build User Trust