Mobile application security is a growing part of the Cyber Security industry. To help us understand and address those challenges, we were joined by Chris Roeckl, the Chief Product Officer at Appdome, on Episode 31 of The Cyber Security Matters Podcast. He shared his perspectives on the state of the sector, his insights into the key challenges of keeping mobile applications secure and its impact on compliance. Read on to find out what he said. 

How do you assess the state of the mobile security space as a whole?

The mobile app security market is rapidly changing. There are lots of reasons for that. Probably the most important one is that mobile apps are now the dominant channel for interacting with digital brands. It’s not about websites anymore, it’s all about mobile. The bad news here is that people who break into networks are zeroing in on mobile apps, which is driving the mobile security market. 

The challenge, particularly in today’s economy, is that CISOs and other decision-makers within mobile app security don’t have as many resources as they had in the past. They are either freezing their hiring or letting go of developed cybersecurity engineering teams just to cut costs. It’s like that old analogy of cutting off your nose to spite your face, but it is the reality of business today. They’re also trying to zero in on how to do more with less because 

budgets are under scrutiny. The thing is, bad actors aren’t taking the day off because of budget cuts and personnel reductions. The number of attacks just continues to grow and grow and grow. 

We don’t like to focus on scaring our customers or prospects, we want to help them. We don’t spend much time talking about the bad actors doing bad things, but they are, and the mobile brands we support know that. We don’t have to take that message to the market, so our focus is on getting them to an outcome. How do we how do we solve this problem? Every mobile brand’s challenge is unique, and our goal is to make sure that we can solve those unique challenges for them. 

How are these key challenges within mobile application security addressed?

The first thing that you have to realise is that web-based and desktop apps basically all have the same technological components, which makes it fairly simple to solve security problems. Now, in the mobile world, apps are built with 15 different development frameworks, which you can mix and match. You may have heard of things like Swift, Java, or Kotlin. They’re all different languages that you can code in. That creates unique scenarios. It’s not homogenous; it’s heterogeneous, which makes mobile app security difficult. 

The other thing is that there are a couple of different approaches to solving that. If you go back 5, or 10 years, software development kits were developed by security companies for mobile, and they basically give you some code. Your job as an enterprise or mobile brand was to add and maintain that code in your own application, which had its own challenges. The most simple challenge was that the software development kit you got might only work with 3 of the 15 development frameworks, so as a mobile developer, you have to make a choice to say either I need to rewrite my app to get in the security bits, or I need to go look for some other solution and then cobble it all together. 

At Appdome, we decided to take a completely different look at the market. We built a machine that takes account of all these frameworks and then builds an implementation of the security based on the buttons you tick on the platform for the security protections you need, and delivers that solution, with no coding needed. In a world where you’re losing resources, we think the movement to more of a machine-based approach to mobile app security is going to win the day. 

How does that impact the compliance side of things?

Cyber compliance is a really critical topic. Firstly, there are external regulatory compliance requirements. Secondly, there are a bunch of internal-facing requirements. Mobile brands oftentimes publish some sort of cyber pledge on their website for general security, saying ‘We protect your data this way.’ What is becoming very apparent is that those cyber pledges apply to the mobile app too – it’s not just about the website anymore. It’s not just about the way that your data is protected in the backend infrastructure; it is all about the mobile end user using a mobile app. 

Being able to do things like ensure that the cyber protections are actually built into the app is a cyber requirement, but the work is done by developers. So how do you bring the developers and cyber team together? Do you produce artefacts within the production process that say, ‘This encryption was added’, ‘Obfuscation was added’, or do you reverse engineer whatever the features are that the mobile brand is looking for? The ability to do things like UI testing is super important too. All of those compliance elements have to fit together into this jigsaw puzzle called mobile app development. Over the last two years, we’ve seen this go from kind of a low-level thing to a high priority within cyber organisations.

To find out more about securing mobile applications, tune into Episode 31 of The Cyber Security Matters Podcast here. 

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.