For the next few minutes, I want you to think about app security. It is a known fact that almost all apps undergo some kind of functionality and usability testing. Developers make sure their apps don't crash and behave as specified. Security aspects are usually not checked, in the worst case neither implemented nor designed. Based on my experience as mobile tester, I would estimate that 90 percent of all published apps won't undergo any proper security tests. I’d be deeply surprised if the true number is much lower.
But why are we even talking about mobile security in particular? That’s really a question that I frequently hear. Isn't it just security in general? Aren't we just building an app on top of Apple's ecosystem? Isn’t iOS already very secure? Why do I as a developer need to think about mobile security in the first place? Applications are sandboxed so you can't do much harm with an application anyway. You can't break out of the sandbox. These are the main arguments I hear, when I talk about mobile security and partially they are true.
Apple makes sure, that their system is secure and they’ll test the applications when you submit them to the app store. Part of it is also wrong, because you have degrees of freedom as a developer. If you build an application, you can do anything that the API and SDK allows you to do and on top of that you can do stuff that is not allowed but possible.There are for example private or undocumented APIs, that you can use. If apple doesn't detect them in the app approval process then you will get away with it. Sometimes developers don’t even know that they’re using a private API. You’ll find a lot of private API usage scenarios, when you’re browsing through StackOverflow answers.
Additionally security is hard to get right and there's a reason for that too. Mostly security is not really part of a standard developer career. Usually an app developer will not get a full-fledged course about security standards, best practices, security building blocks or cryptography.
The answer is because security is a shared responsibility. It's shared between three main parties - the developer, the user and the system manufacturer. So Apple trusts you with their devices and user experience and the user trusts you with their data and sometimes even with their money. Most importantly the user trusts that your app is secure. So you can't get out of it just saying okay I don't care – um – I really just want to build an application.
If you don't build a secure application you will just misuse the trust that the user has put into you. The second part is you can do harm within applications. You can cause the device to to like behave in a way that is not proper. That’s why you have to be aware of your responsibility and you have to take into account that you share part of the responsibility as a developer and that you can't get out of it just by saying okay i don't care.
So if you are a developer, please start caring about app security now.