MOBILE APPLICATION SECURITY TESTING: Your app operates on devices you do not control.
Mobile application security testing examines how an app protects information on the device and across its connections to backend services. We assess local storage, platform features, communications and user permissions to establish where someone could extract sensitive data, interfere with the app or cross an access boundary.
- Discipline
- Cyber Defense
- Engagement type
- Assessment
The mobile client is one part of the system.
A device can be lost, inspected or modified. Data may remain in local files, logs or backups, while the app's interface can conceal API functions that remain reachable directly. A useful assessment distinguishes what the client protects from what must be enforced by the backend.
Good times to assess
before releasing a sensitive-data feature; after changing authentication or third-party SDKs; when a customer requires independent testing.
Examine what the app stores, exposes and trusts.
Information on the device
Storage, caching, logs and other locations where sensitive data or credentials may persist.
Platform interactions
Permissions, deep links and communication with other applications or operating-system features.
Network communication
How the client establishes trust and exchanges sensitive information with remote services.
Identity and session behaviour
Sign-in, logout, token handling and access to sensitive actions.
Backend boundaries
Where agreed, whether server-side controls uphold the permissions the client interface presents.
Define the platform, build and backend together.
We agree which application builds, operating systems and device conditions the assessment covers. Supporting API access is defined separately where needed. Findings explain the affected behaviour, how it was reproduced and whether the corrective change belongs in the client, backend or both.
What you receive
A record of the builds, platforms and test conditions examined.
Device and communication evidence for the issues identified.
Findings separated by client-side and server-side responsibility.
Are Android and iOS assessed in the same way?
They share some security concerns but use different platform controls and application structures. Coverage and access requirements should be set for each platform and build included.
Does app-store approval establish that an app is secure?
Store review serves a different purpose and does not replace an assessment of your application's data flows, permissions and backend behaviour.
Does this include the entire backend?
Only when that coverage is agreed. The assessment should state which APIs and services were examined and which remain outside scope.
What changes when your next build reaches users?
Tell us which platforms you support, what the app handles and when you plan to release.
Related services: API Security Assessment and Source Code Review.