Check out what our corporate members are doing!

Our thoughts on cloud security

Recap of the previous edition
In the previous edition, the topic was centered around legal aspects of cloud computing. For example, due to the geographical distribution of data centers, data stored in these data centers are subjected to different local laws and regulations in terms of how data is to be governed. These aspects should be considered when we purchase cloud services. In this edition, we will be looking at security issues that are much closer to our daily lives – security issues of mobile apps.

Can we live without our mobile devices?
Can you imagine life without your mobile devices? When was the last time you used your mobile device? How many mobile apps are installed in your phone?

Recent statistic pointed out that the number of global users of mobile devices has passed the number of desktop users in the year 2014 [1]. People tend to spend more time with their mobile devices than with their desktops. In fact, 89% of their time spent on media is through the mobile apps.

In this episode of the Memoirs of an Analyst, we would like to talk about the security issues around mobile apps. Researchers have been saying that users tend to ignore terms & conditions and permissions requested by the apps [2]. However, does reading through the T&C and permissions grantee that the app is safe to use? Not at all.

What happen if the app is not secured?
Imagine that Instagram app is installed in your phone and has permission to take photos with your phone’s camera. If Instagram app itself is not secure enough, it might get compromised. Then malicious users can take photos via the camera without notifying you. In fact, if an app which has permissions to operate your phone in different ways (e.g. Facebook app has over 30 permissions to control your phone) get compromised, the malicious user can do more than just to take photos with the camera.

What can we do?
To make sure mobile apps are secure, a standard vetting and certification scheme should be developed. Through vetting and certifying mobile apps, app developers will be able to identify and fix the flaws in the apps before releasing it in the market. More importantly, users can understand how secure an app is before installing it onto their devices.

Our Mobile Application Security Testing (MAST) working group is working on a white paper about app security testing and vetting process which uses both static and dynamic analysis to analyse apps. Including dynamic analysis in the testing and vetting process is a must as some of the flaws may not be detected by static analysis [3]. Through analysing areas such as permissions, data protection, application collusion, code obfuscation and password management. We can identify either an app is secure or not.

The testing and vetting process will further be developed into our certification scheme. The certification scheme certifies apps with a maturity model. Similar to CSA STAR, the CSA mobile application security testing certification scheme will allow users to understand how secure an app is just by seeing the certificate issued by CSA.

In the future, when you see an app is CSA certified, do not hesitate and install it!

[1] D. Bosomworth, “Mobile marketing statistics 2015”, Smart Insights, 2015. [Online]. Available: http://www.smartinsights.com/mobile-marketing/mobile-marketing-analytics/mobile-marketing-statistics/. [Accessed: 01- Oct- 2015].

[2] P. G. Kelley et al., “A Conundrum of Permissions: Installing Applications on an Android Smartphone,” in Lecture Notes in Computer Science, vol. 7398, Financial cryptography and data security, J. Blyth et al. Heidelberg: Springer, 2012

[3] S. Quirolgico et al., “NIST Special Publication 800-163 - Vetting the Security of Mobile Applications”, National Institute of Standards and Technology, Gaithersburg, United States, 2015.

J. Chin, “Apple Targeted as Malware Infects China Mobile Apps”, WSJ, 2015. [Online]. Available: http://www.wsj.com/articles/apple-targeted-as-hackers-infect-popular-chinese-mobile-apps-with-malware-1442750168. [Accessed: 01- Oct- 2015].

T. Kontzer, “Most of Your Mobile Apps Have Been Hacked'” Baselinemag.com, 2015. [Online]. Available: http://www.baselinemag.com/enterprise-apps/slideshows/most-of-your-mobile-apps-have-been-hacked.html. [Accessed: 01- Oct- 2015].

J. Pagliery, “Hackers are draining bank accounts via the Starbucks app”, CNNMoney, 2015. [Online]. Available: http://money.cnn.com/2015/05/13/technology/hackers-starbucks-app/. [Accessed: 01- Oct- 2015].

Arxan, “Arxan’s Annual Report: ‘State of Mobile App Security’ Reveals an Increase in App Hacks for Top 100 Mobile Apps – Arxan”, 2014. [Online]. Available: https://www.arxan.com/arxans-annual-report-state-of-mobile-app-security-reveals-an-increase-in-app-hacks-for-top-100-mobile-apps/. [Accessed: 01- Oct- 2015].

The latest updates about CSA APAC events and activities.

The latest updates about CSA APAC supported conferences

Featured chapter of the month

The Cloud Security Alliance Taiwan Chapter was co-founded by its Secretary General, Aha Lin and Yi-Lang Tsai, who is the Chairman of the CSA Taiwan Chapter. The chapter works with many Taiwanese domestic cloud services and computing associations to establish a benchmark for local cloud security industry. The Taiwanese cloud services industry is facing various foreign challenges and is also in the process of establishing cloud security operating policy. Therefore, the CSA Taiwan Chapter plays a critical role in shaping the cloud security standards in Taiwan. The main objectives of Taiwan Chapter are to assist domestic development of information security framework in cloud services, promote cloud security certification and relevant trainings. Other than regular knowledge sharing seminars and annual Taiwan Summit, the chapter also organises hacking competitions for all age groups and information security camps for children and teenagers.

Yi-Lang Tsai is the Cloud Security Alliance Taiwan Chapter Founder and Chairman. He is also the chapter leader of the Honeynet Project in Taiwan. He is a Research Fellow at the Taiwan Computer Security Incident Response Team, where he works for the Taiwan Academic Network (TANet) to detect and analyse security incidents. He is also a Director at the National Center for High-Performance Computing, where he leads and manages major security projects. In addition, Yi-Lang is an expert in UNIX/Linux, Windows OS, communication network technology, network security, ISMS and digital forensics. He is also a well-known IT commentator and author in Taiwan, having published 34 books and written many columns in various professional IT publications.

Come and Join Us!