Over the last decade, the Internet has undergone a very important evolution, becoming one of the main advertising and sales channels that many companies use today. Fear of fraud is the first response that arises when questions about company security are asked, but it is necessary to consider every aspect involved in the security of applications and the communication between them. The Mobile Application Audit will detect deficiencies or security vulnerabilities in the analyzed application.
The actions carried out to perform the Mobile Application Audit follow a black-box philosophy; that is, at no time is the application’s source code audited.
The reason for this working methodology is to simulate the real action of a malicious attacker who, through the audited applications and without having access to their source code, attempts to attack the system.
To carry out the audit of corporate applications, we divide the process into several phases:
Functional Analysis
A general study of the application is carried out, acquiring a global vision of the functionalities it provides in order to plan the optimal actions and procedures to be carried out in the Technical Analysis.
Technical Analysis
An analysis of the application is carried out to determine which types of attacks it is sensitive to.
Test Design
In this phase, the tests to be carried out are designed to exploit any security deficiencies that may appear in the audited application.
Test Development
The tests to be executed will be programmed and the order in which they will be carried out will be determined.
Test Execution
During this phase, all tests are carried out on the audited application, the results obtained are analyzed, and if new vulnerabilities are detected for exploitation, the process returns to the design phase to attempt to exploit them.
Tests for Information Gathering
- Analysis of requirements necessary for the Audit.
- Analysis of Communication requirements.
- Analysis of the application's functionalities and/or features.
- Analysis of the application's software architecture.
Tests for Static Analysis
- Requirements necessary for code auditing.
- Review of the Authentication process.
- Review of Information storage methods.
- Management of Secure communications.
- Search for accessible sensitive information.
Tests for Dynamic Analysis
- Analysis at the Client App level.
- Analysis at the communications level.
- Analysis at the server or backend API level.
After executing the tests, the obtained results are analyzed and the associated documentation is generated.
- Executive summary of the Audit result.
- Results obtained in the different tests performed, identifying the security issues found and specifying the conditions under which they were found, so they can be reproduced (as far as possible) to facilitate their location and resolution.
- Recommendations to most appropriately resolve the security issues found.
- Classification of the detected security issues according to their level of severity.
