CASE STUDY - Ironclad Messaging & Secure App Dev for Regulated Industries

© Copyright 2018 NowSecure, Inc. All Rights Reserved. Proprietary information. Do not distribute.© Copyright 2018 NowSecure, Inc. All Rights Reserved. Proprietary information. Do not distribute.
CASE STUDY:
IRONCLAD MESSAGING &
SECURE APP DEV FOR
REGULATED INDUSTRIES

© Copyright 2018 NowSecure, Inc. All Rights Reserved. Proprietary information. Do not distribute.3
#MOBSEC5 - A WEEKLY MOBILE SECURITY NEWS UPDATE
www.nowsecure.com/go/subscribe

© Copyright 2018 NowSecure, Inc. All Rights Reserved. Proprietary information. Do not distribute.
AGENDA
INTRODUCTIONS
MOBILE APP SECURITY LANDSCAPE
VAPORSTREAM CASE STUDY
NOWSECURE SOLUTIONS
RECOMMENDATIONS
Q&A
4
SPEAKERS
AVI ELKONI
COO/CTO
VAPORSTREAM
KRISTI PERDUE HINKLE
VAPORSTREAM
BRIAN REED
NOWSECURE

HOW SAFE ARE YOUR MOBILE APPS?
Web and App
Breached of
PII & Credit Card
Mobile App Breach
Exposing 20,000
Customers
Data Breach
Reveals Military
Training Sites

NOWSECURE BENCHMARKS: BANKING & FINANCE
0 59 60-69 70-79 80-89 90-100
*Scoring algorithm based on Industry Standard CVSS Scored findings
Low RiskHgh Risk Caution
A significant 10 of 100 Apps (10%) fail w/ critical & high risks
Identified Failures: Man in Middle Attack, Invalid Certificate,
Known Vulnerable 3rd Party Libraries, Unencrypted
credentials/PII in local files or over HTTP
NowSecure Score Risk Range 46-100

NOWSECURE BENCHMARKS: RETAIL
0 59 60-69 70-79 80-89 90-100
*Scoring algorithm based on Industry Standard CVSS Scored findings
Low RiskHgh Risk Caution
NowSecure Score Risk Range 6-100 A shocking 27 of 80 Apps (34%) fail w/ critical & high risks
Identified Failures: Man in Middle Attack, Invalid Certificate,
Known Vulnerable 3rd Party Libraries, Unencrypted
credentials/PII in local files or over HTTP

INSIDE THE MOBILE ATTACK SURFACE
iOS
APPS
iOS FRAMEWORKS
iOS NATIVE LIBRARIES
iOS Mach/XNU KERNEL
iOS HAL
HARDWARE
CODE FUNCTIONALITY
DATA AT REST DATA IN MOTION
Data Center
& App Backend
Network &
Cloud Services
TEST
APP
GPS spoofing
Buffer overflow
allowBackup Flag
allowDebug Flag
Code Obfuscation
Configuration manipulation
Escalated privileges
URL schemes
GPS Leaking
Integrity/tampering/repacking
Side channel attacks
App signing key unprotected
JSON-RPC
Automatic Reference Counting
Dynamic runtime injection
Unintended permissions
UI overlay/pin stealing
Intent hijacking
Zip directory traversal
Clipboard data
World Readable Files
Data caching
Data stored in application directory
Decryption of keychain
Data stored in log files
Data cached in memory/RAM
Data stored in SD card
OS data caching
Passwords & data accessible
No/Weak encryption
TEE/Secure Enclave Processor
Side channel leak
SQLite database
Emulator variance
Wi-Fi (no/weak encryption)
Rogue access point
Packet sniffing
Man-in-the-middle
Session hijacking
DNS poisoning
TLS Downgrade
Fake TLS certificate
Improper TLS validation
HTTP Proxies
VPNs
Weak/No Local authentication
App transport security
Transmitted to insecure server
Zip files in transit
Cookie “httpOnly” flag
Cookie “secure” flag
Android rooting/iOS jailbreak
User-initiated code
Confused deputy attack
Media/file format parsers
Insecure 3rd party libraries
World Writable Files
World Writable Executables

§ Founded in 2008
§ Based in Chicago, IL
§ Privately owned and backed by investors and VC funding
§ Clients in Healthcare, Financial Services, Energy & Utilities, Higher
Education, Government and more
§ Vaporstream is a comprehensive and configurable platform that
addresses a wide variety of use cases for secure communication
10
ABOUT VAPORSTREAM

THE VAPORSTREAM SECURE COMMUNICATION PLATFORM
11
Vaporstream delivers a secure, ephemeral, compliant platform built to increase efficiency and
revenue opportunities for the enterprise. While uniquely protecting sensitive data, Vaporstream
automates processes to increase work team efficiency and create new levels of service delivery.
Analytics
Compliance
Engage
Secure
Messaging
Vaporstream Platform

§ Healthcare
§ Patient Care Coordination
§ Patient Engagement
§ Surgical workflow/Instruction delivery
§ Billing/Insurance submission
§ All Industries
§ Incident notification and response
§ Mass communications
§ Compliant, secure, leak-proof business messaging
§ Crisis and reputation management
§ Executive and Board communication
§ Strategy, IP, Legal, M&A, HR/ Recruiting
§ Financial transactions
§ International travel
§ Others
12
SECURE COMMUNICATION USE CASES

VAPORSTREAM’S MULTI-LAYERED SECURITY MODEL
13
§ Automated message expiration based on enterprise policy, group and user
§ No footprint left on any device, nor server
§ Shred on demand gives ultimate sender control
Ephemerality
Encryption
§ Encryption of data in transit and at rest
§ Keys and data always kept separate
Governance & Compliance
§ Archive a single copy of messages to client-specified repository to
safeguard information for legal, regulatory and business requirements.
§ Client data remains under client control; never stored with vendor
§ Comprehensive audit logging and reporting
Advanced Controls
§ Unique Sender Controls prevent data propagation to unintended recipients
§ In-app camera keeps all images from upload to iCloud, Google, never
stored on devices
§ Screenshot detection and protection
§ Message Body / Header separation

1. Extensive black-box penetration testing
§ Apps
§ Platform
2. Dedicated staff for each platform
§ iOS
§ Android
3. Dedicated equipment
§ Jailbroken iOS devices
§ Rooted Android devices
4. Detailed reports with actionable findings
14
VAPORSTREAM MOBILE APPSEC TESTING REQUIREMENTS

§ Known and reputable
(Strong reputation)
§ Dedicated and experienced teams
§ Black box testing minimizes stress
on development team
§ Continuous testing keeps us
protected between certifications
15
VAPORSTREAM CHOOSES NOWSECURE

§ Started with initial certification in 2014
§ Recertify every year
§ Work certification recommendations into
product releases
§ Apply NowSecure AUTO to every store
release as part of our standard QA
process
§ Use our NowSecure Certification as
third-party validation
§ Vaporstream differentiation
16
HOW VAPORSTREAM USES NOWSECURE TODAY

VAPORSTREAM NOWSECURE CERTIFIED

1. Design for security
2. Test from first prototype
3. Incorporate security testing into
your regular QA cycle
4. Prepare for enterprise customer
security audits
§ Document internal procedures
§ Hoard certifications
18
VAPORSTREAM RECOMMENDED BEST PRACTICES

NOWSECURE – DELIVERING SECURE MOBILE APPS FASTER
Automated Mobile AppSec Testing
Optimized for Speed, Accuracy, Integration
Powers Security in Agile & DevOps Teams
Expert Pen Testing, App Certification & Training
Advanced Expert Research & Engineering Teams
Wrote the book on mobile forensics
Trusted by world’s highest security organizations

NOWSECURE APPSEC TESTING COVERAGE CHECKLIST
✓ Man in the Middle: Cert Validation
✓ Man in the Middle: Cert Pinning
✓ Man in the Middle: HTTP Connections
✓ SSL Downgrade
✓ Unprotected TLS traffic
✓ Cookie integrity
✓ Certificate Validity
✓ App Transport Security
✓ …
✓ App files & Log Files
✓ Keychain
✓ SD Card
✓ World Writable Files
✓ World Readable Files
✓ RAM
✓ Unencrypted credential storage
✓ SQLite Databases
✓ Secure Enclave Processor
✓ …
✓ Development flags
✓ Automatic Reference Counting
✓ Stack Smashing
✓ Bad Authentication/Authorization
✓ Root access
✓ Path Traversal
✓ SQL Injection
✓ Vulnerable 3rd party libraries
✓ Heartbleed
✓ Bad cryptography
✓ Obfuscation
✓ …
CODE FUNCTIONALITY DATA IN MOTIONDATA AT REST
Data Center
& App Backend
Network &
Cloud Services
iOS
APPS
iOS FRAMEWORKS
iOS NATIVE LIBRARIES
iOS Mach/XNU KERNEL
iOS HAL
HARDWARE
TEST
APP AUTOMATED MOBILE APP SECURITY TESTING PLATFORM

NOWSECURE AUTOMATION PLATFORM
NowSecure AUTO
NowSecure WORKSTATION
NowSecure INTEL
NowSecure SERVICES
Continuous Integration Continuous Monitoring
Automated Security Testing in SDLC
for Dev, QA & Security Teams
Deep Pen Testing Analysis
of Complex, High Risk Mobile
Apps for Security Analysts
Public App Store Risk Data
for EMM, Threat & Security Teams
Expert Pen Testing, Training &
Mobile App Security Programs for App
Owners, Dev & Security Teams
Data
Repository
Dashboards &
Reports
Advanced
Configuration
Device
Farm
Compliance
Mapping
Analysis
Engine

PHASES OF SHIFTING LEFT WITH NOWSECURE
Dev Cycle
Auto-Generate
Issue Tickets
Build
Binary
Code
Commit
Test
Binary
</>
Stage Deploy
Auto-Test
Every Build
Monitor
App Store
Production
On-Demand
Auto Test
Annual /Periodic
PEN Test

INSIDE NOWSECURE MOBILE APP RISK SCORING

Fully automated mobile app security
testing solution for Agile & DevOps
Shorten time-to-release with security
baked in
Full "hands-free" automation
Rapid test results in minutes
Real-world tests on real iOS & Android devices
Highly accurate findings & developer-friendly
remediation tips
Plug-in integration to the SDLC with
no new tools for developers to learn
Auto test every build
Auto generate security tickets
Auto route info to all stakeholders
25
NOWSECURE AUTO POWERS SECURE DEV TOOLCHAIN

Leverage Our Years of Collective
Expertise in Mobile App Security
Accelerate Your Mobile App Security
Program
Expert Setup & Guidance
MAST Program Development
Dev & Security Quarterly MAST Training
Mobile AppSec Staff Augmentation
Expert Pen Testing & Certification
+100 Man Years Experience
+1000 Mobile Apps Tested
Advanced MAST Forensic Skills
26
NOWSECURE SERVICES EXPERTISE FOR SUCCESS

NOWSECURE INTEGRATES WITH YOUR DEV TOOLCHAIN
APP MANAGEMENT TOOLS
BUILD TOOLS
MOBILE APP STORES
VULNERABILITY MANAGEMENT
ISSUE TRACKING
MDM/EMM
…
…
…
…
…
…
Application
Binary
Security
Assessment
Build Status
Monitored
Applications
Notifications
Data
Repository
Dashboards &
Reports
Advanced
Configuration
Device
Farm
Compliance
Mapping
Analysis
Engine
ARCHER
GITHUB MS VSTS
MOBILE IRONMS VSTSCIRCLE CI XAMARIN
HOCKEYAPPTESTFLIGHT
APP STORE PLAY STORE

THE PATH TO CONTINUOUS SECURITY
Manual Testing
PEN Test
PRE RELEASE
Test
ON DEMAND
Full CI/CD
Integration
Integrate with SDLC infrastructure
Test every build every day
Auto-generate tickets from
findings in local ticketing tool
Auto-route reports to risk &
compliance stakeholders
Auto-route results & trends to
management dashboard
Perform deep-dive investigations
when needed
1 mo 3 mo 6 mo 12 mo
Maximizing Value &
Performance

OPEN Q&A
Use the “Ask a Question” tab below the slides
AVI ELKONI
COO/CTO
VAPORSTREAM
KRISTI PERDUE HINKLE
VAPORSTREAM
BRIAN REED
NOWSECURE

CASE STUDY - Ironclad Messaging & Secure App Dev for Regulated Industries

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to CASE STUDY - Ironclad Messaging & Secure App Dev for Regulated Industries

Similar to CASE STUDY - Ironclad Messaging & Secure App Dev for Regulated Industries (20)

More from NowSecure

More from NowSecure (13)

Recently uploaded

Recently uploaded (20)

CASE STUDY - Ironclad Messaging & Secure App Dev for Regulated Industries