Refreshing our Approach to Mobile App Security [Introductory]

So, a warm welcome from my side. Hope you had a good conference so far.

So, let's talk a little bit about mobile app security or mobile app in general. So, why is that topic a real hot deal at the moment? Everybody drives towards mobile app experience, right? Mobile-first approaches and so on. That's what I really want to give you some awareness of, right? And how to secure it.

But first, come up with some statistics because they are really interesting. Honestly, I was not aware of these kind of numbers, right?

Of course, we know that we are 8 billion users actually on Earth. But do you know that there are 5.78 billion unique mobile device subscribers out there? Of this number, you have 5.56 billion users that use Tinder daily. I think these are really huge numbers. And then coming up with the next slide, some more statistics that really underlines why app security or mobile app security is really, really important, right?

When you're looking at the bottom line right here, and you're looking at the numbers, the users using Internet every day is around about six and a half hours, over six and a half hours, which is immense. And when you're looking at the statistic right next to it, 96.3% are using Internet via mobile devices, right? So this is really a massive number that really underlines that mobile app security must be in everybody's mind when really dealing with security in any kind of way. So really massive numbers just give you some of these.

Also, just another statistic, sorry for that, but this is really interesting. When you're looking at these numbers, these are showing if there are concerns about personal data misuse. And when you're looking at the numbers, right, I think they're starting in 2022, and they're decreasing. I think it's also interesting, right? So the attack surface of threats are getting bigger and bigger, and nobody's really concerned about the misuse, if they are really hacked or not. So this is really some kind of interesting thing.

And when you're looking at the right side, so it's really showcasing how the generations think of this one. So they're just putting together some statistics from 16 to 24, as you see it right now. You see that at the age of 45, they are getting a little higher, right? So these are maybe the generations that are really a little bit new to mobile device usage and so on. They're just finding into that mobile-first approach right now. They're not really concerned of sharing that personnel data in any kind of way. So this is really some kind of interesting thing.

So in my opinion, just another statement from my – it's a really big thing. We really had huge numbers right here with the devices, the subscribers and so on. So we really have to take care of that in our mobile app security approach. So when we're talking about mobile app security, there are basically four layers of security that you can use as some kind of a pattern to really make your app security as good as possible. So we have three. We have code and resource hardening, which means your developers have to take care of code obfuscation patterns and so on.

This is really fortifying the app code itself. So normally a user cannot do anything about it. Secure runtime environment. So you really have to take care that you're using the runtime environment, like iOS, Android, the best you can for really getting the best security out of it without having any memory dumps or whatever. Next thing, three. It's a little bit more also a use case for customers. Secure network communication. So this is some kind of an approach that gives you or a layer that gives you the communication way from your app to external services, right?

And cryptographically encrypted data transfer and whatever. So also a layer that's really important.

And, of course, application integrity in the form of non-manipulated apps that you're using for and really definitely having the integrity completed. So just some coming from the layers to some threats. So I think you heard that a lot. The tech service will grow year by year. There will be much more threats in the upcoming years due to AI and so on. But I just will mention some of these here because these are, in my opinion, the most common ones currently on the market. So you have phishing scams. You have smishing scams. You have network spoofing. The previous speaker talked about that.

Also, we have improper session handling. We have weak passwords. I think weak passwords will still be there for the next couple of years until really everybody choices this kind of passwordless approach. So there's a lot of stuff that we can really, as a consumer, can really give ourselves a little bit more hint of using the right tools for it. This really something that every layer that we've mentioned before can really be attacked on these kind of security threats that I mentioned in here. What does that mean for our app or for a mobile system at all?

So it must be protected in any kind of way. We definitely have to build up some kind of a protection shield around the mobile device environment in any kind of way. It doesn't matter if it's the OS, if it's the app itself. So we really have to be sure that we are considering every kind of possibility to really getting these attack vectors as small as possible so that you're really minimizing any kind of friction here. So this is a really big thing.

Of course, we cannot cover every kind of these threats that I've mentioned before. What I really want to talk about is I just picked out two of these. So we have weak passwords. I think everybody's clear, right? You cannot go with some passwords like test, one, two, three, exclamation mark. So these are easy to guess, right? Everybody will definitely guess it anyway. But also a big threat in our opinion here is improper session handling. So really hijacking the session, getting the access token, getting the refresh token to really get access to the unbound system. So this is really a big thing.

That's why I really want to focus on this improper session handling because I think this is really some kind of a main pattern that can easily be resolved and really improved in any kind of way. Let's just talk about this. I brought up some kind of a little example in here, which is some kind of a refresh token grant flow. It's getting a little bit more technical, but at the end, this is basically something, okay, you're just entering the app. You're just authenticating against the app Authenticating against the authorization server, of course.

If it's successful, you're getting an access token and a refresh token that comes back from the authorization server. And you're just using the access token for granting access to the service. And at the end, the refresh token is everything that is needed to really get another access token if the access token expires. So that means everything on that kind of concept this year is relying on the refresh token. That means whenever the refresh token is gone, you have to authenticate again.

Otherwise, you have the refresh token. That also means if there's some kind of a fraudster coming up to your session and just grabs the refresh token, he can easily hijack your system. By just grabbing the refresh token, you can easily get into the scenario of getting an access token granted for himself and just use the service on your behalf. So this is really something that is currently a much-used pattern in mobile app development. So that's why I really want to say this could be some kind of a problem here. So the refresh token. How we can get rid of this refresh token? Just to get an idea.

First, we just understand the problem. The problem itself is that most applications are just using their first layer of protection, which is completely hard-coded in the app. So the app takes care of using biometrics, like touch ID, face ID, or whatever, or a password, and just using an OAuth client for getting an access token from the authorization server. That means the whole interaction of the application and the authorization is based on that refresh token.

And there's no other stuff that is really shared with the authorization server to make more analytics or giving more beef for the authorization server to get more complex and advanced scenarios right here. Because what's in that refresh token? It's just some encoded string that the OAuth server can interpretate and just issue another token. So it's really no media information that can be used to really have a much more advanced authentication process initiated.

That's why we can really shift some stuff that really gives us more opportunities to get it all handled properly and much more securely. So when we say we're just moving some from your application towards the authorization server, it gets really much more solid in regards of the authentication process, as well as the security, it will increase a lot. So what we're doing, we definitely leave the OAuth client on the left side, because this is our communication medium, and we're using that protocol. No worries.

But what we want to do is we want to shift all the necessary authentication parts to the authorization server, like all the MFA parts, which are Face ID, Touch ID, which shall be part of the whole authentication journey that is initiated by the authorization server itself. Therefore, we will get all the information coming out of these services that are implemented in the authorization server. We can really handle that in any kind of way. We can really force strong authentication afterwards.

But everything should be in the authorization server to be handled in the best and secure way that is possible. And how shall we do that?

Of course, there are policies in place, really depending on the vendor and the solution itself. You can use a policy for it to make that, to execute it. But the better approach would be some kind of an orchestration tool, which gives you a much more free canvas to really set up the user experience and user journey the way you really want, to really integrate every kind of service that is needed to really build the best user experience and user journey that you have. Why I'm just mentioning this with the orchestration tool is I just want to come to that kind of little quote right here.

I think this is really something that should be some kind of a mantra, in my opinion, in our security spaces. It's really about the balance between security and user experience. You definitely need a secure system, but it should be handleable by every kind of customer right now. And it should be seamless, frictionless, and as easy as possible. So this is really something that we see much more, that sometimes user experience is much more important than security. So this is really a thing that really gives us some more thoughts on the whole overall situation in regards of securing services.

And that's why we think that orchestration is key, even in building up mobile app security authentication processes, where we think that for us, it doesn't matter what kind of app it is, what kind of users are involved in using that app. We don't really care. It's all about that we need a really good journey for the user that is secure and as flexible as possible to create the best user experience and the most secure way of getting access to a service.

That's why we have that kind of sketch in here, which showcases some kind of a way from authentication into the service, which we can definitely run through in a bit. So what should that be? So it should be, okay, users coming into your app, the app can't be compromised, right? It could be a suspicious device that the user is using with the app. The app will definitely not check that, right? Because you just download the app from the app store, which should be qualified. There should be a quality assurance process before. But at the end, nobody knows if this is a compromised phone.

So that's why we just say, okay, orchestration can not only help with authentication, it also can stop the authentication process instantly after somebody tries to log in. So that's why we have that protection layer. Afterwards, it's just about authentication itself, managed user profiles, giving access, whatever.

But everything in the core of that whole scenario is based on an orchestration tool that gives you all the flexibility to really onboard every kind of external services that is needed to really build the best user experience, user journey on your behalf, and really on a user-focused approach. And of course, at the end, you're getting access to the service, just creating issue a token in any kind of way. So this is really something that we see as some kind of a key.

We need some kind of a flexible tool that gives us all the possibilities to really build up a user-centered authentication journey in all that kind of place. And it doesn't matter if it's a web app or if it's a mobile app. So this is definitely a general approach that we see is really valuable for every kind of way that really secures our behavior. And also it really generates trust in that case. And also just give you some more advantage when you're having an orchestration tool in build right here. As mentioned many times before, you can definitely do anything in there.

So you can really build your individual authentication journey. But everything that I would say is also include all necessary data. That means you can really build single end-to-end experience without jumping from channel A like mobile device to web app or whatever. So this is really also a good thing. And really important when we're talking about mobile development at the end. So orchestration tool are just plugged into your development. That means whenever you have this kind of journey called, it doesn't have anything to do with the deployment of the app at all.

But you don't have to release a new app version for it. Because you're just switching the version of the orchestration journey at the end, which is plugged in. So this is really some kind of a big benefit. So it's really independent from the development lifecycle of the mobile app. So this is really some kind of a big deal that really gives you some advantage of using this kind of orchestration tools. I just want to end. So we're pretty close to the end. So I just want to come back to one of the statistics.

And I would say just for 5.78 billion mobile device owners, user experience and security is not optional. So this is really the key message of my session. So thank you very much. Have a great conference. Maybe speak later. Okay.

Well, thank you very much. You know the drill. If anybody has a question, please raise your hand. In the meantime, we have actually one from the online audience. And that kind of a question I can get behind as well. Where do you draw the difference between a mobile device and something else? Does it really matter nowadays? Whether it's a tablet, a phone, or a laptop or something? I think we do. We don't make a difference between a mobile phone or a smartphone or tablet. So this is really something that we're not differing with.

So at the end for us, it's basically there's currently some kind of a shift to really go into mobile-first approaches. And we definitely see that when you're looking at, for example, a lot of retailers or so on, they're really developing apps that are much more user-friendly than their web.com apps. And for us, it's really all important that we are just really covering the right OS, operation systems, so forth. But we really don't really differ between mobile devices in regards to smartphones. And by the way, where does the AI fit into it?

Can AI architectures, can AI agents, for example, use the same approach? The AI, what you have seen in the core, right? So it's basically there are two ways how we interpret AI in our approach. So AI will definitely help to protect incoming requests. That's just one thing. So the protection layer can be AI-based or should be AI-based because it's all about machine learning and really interpreting the right patterns if it's really the user that really asks for the request. But at the end, it's also for us, it's really interesting.

AI would be really interesting to really have that as a key feature of the orchestration tool as well to really help build these kind of journeys really much more easily and really giving the right options and configurations instantly. So it's just both ways, just for the configuration side, for the administrators as well as for the consumer security as well.

Okay, great. Awesome. Thank you very much again.