Mobile application (in)security - 2nd Integrity Smart Executive Breakfast

•Download as PPTX, PDF•

0 likes•576 views

Presentation done by me and Herman Duarte in the 2nd Smart Executive Breakfast. Images credited to: https://www.flickr.com/photos/2_dogs/15608584698/in/photolist-pMh5rh-7z9ART-p7VxWx-7z9AUV-7HiJTB-7HnE4o-7Cu1Sn-7HnEbu-7HnDZm-7BvfGM-7HnDuQ-7HnDP9-7BvfCK-7HiJoM-7Bz6nf-92sk9u-BDvjQ-4Z8Kom-7B76Yv-8ZoH5N-boVMC1-qkwnSx-7bPUnN-7bPWaL-bHCJEc-7hHtiq-av98aY-7z9ANe-9FFk-dqwACQ-qXsZmm-7zdnwj-6xYN7X-7z9B2D-7z9AXV-7zdo45-7zdnZU-357Hy-9UWz6d-7uXCPC-7z9AGv-7uTNAp-7uXCYo-7uTPh8-7uXDkJ-7uTPc2-7uTN6k-7uTNiH-7uTPmi-7uXDr9 Pixabay.com Common Creative images.

1
30 / 04 / 2015
/// Mobile Application (In) Security
Cláudio André
Herman Duarte

2
• Enquadramento
• Componentes de uma Mobile App
• OWASP Mobile Top 10
• Exemplos práticos
• Impacto no Negócio
• Como proteger o ecossistema
• Q&A
/// Agenda
2

2929
/// M10 - Lack of Binary Protections

3030
/// M10 - Lack of Binary Protections

3232
/// Impacto no Negócio
Data Leakage

3333
/// Impacto no Negócio
Data Leakage
Financial data compromise

3434
/// Impacto no Negócio
Data Leakage
Identity Theft
Financial data compromise

3535
/// Impacto no Negócio
Data Leakage
Identity Theft
Fraud
Financial data compromise

3636
/// Impacto no Negócio
Data Leakage
Identity Theft
Fraud
Reputation Damage
Financial data compromise

3737
/// Impacto no Negócio
Data Leakage
Identity Theft
Fraud
Reputation Damage
Financial data compromise
PCI Violations

39
Defense-In-Depth
39
/// Como proteger o Ecossistema

40
Defense-In-Depth
40
Developer Awareness and Training
/// Como proteger o Ecossistema

41
Defense-In-Depth
Secure Development Best Practises (OWASP)
41
Developer Awareness and Training
/// Como proteger o Ecossistema

42
Defense-In-Depth
Secure Development Best Practises (OWASP)
Threat Modeling
42
Developer Awareness and Training
/// Como proteger o Ecossistema

43
Defense-In-Depth
Secure Development Best Practises (OWASP)
Threat Modeling
Continuous Penetration Testing
43
Developer Awareness and Training
/// Como proteger o Ecossistema

Privileged Activity Monitoring Shell Control Box is an activity monitoring appliance that controls privileged access to remote IT systems, records activities in searchable, movie-like audit trails, and prevents malicious actions. SCB is a quickly deployable enterprise tool with the widest protocol coverage on the market. It is completely independent from clients and servers - integrating seamlessly into existing infrastructures.

Stop Attacks and Mitigate Risk with Application and Device Control

Symantec

Be fine or get fined - Keep up with Regulatory Agencies

Harshad Shah

Talking about maintenance management has become more than just asset life cycles and work orders. According to Safety and Health Magazine, Lockout/Tagout was in the top 5 of most “serious” OSHA Violations for the 2018 fiscal year. How do you keep up with regulatory agencies, making sure your facility complies so you don't receive citations and fines? A preventative maintenance system needs to be in place to make it easier for you to identify what may be safety or maintenance violations.

SOMETHING INTANGIBLE, BUT REAL ABOUT CYBERSECURITY

DialogueScience

Get Your Head in the Cloud: A Practical Model for Enterprise Cloud Security

Symantec

Nico Popp, Vice President, Information Protection, Symantec explains. As users, infrastructure and applications move to the cloud at a record-breaking pace, the cloud has become a paradox: both a dream and a nightmare. Accessibility, scale, price and elasticity drive high adoption while security is a source of constant concern. This session will focus on a practical four pillar model for enterprise cloud security, all supported by real-world implementation.

A Symantec Advisory Guide Migrating to Symantec™ Validation and ID Protection...

Symantec

Who should read this paper: IT, security managers, and executives who use legacy on-premise two factor authentication solutions and are considering a switch to another provider’s solution for two-factor authentication should read this document. This solution brief offers advice about gauging the security of a new solution, understanding the ease of deployment and management, choosing the right strategy for migration, and measuring the total cost effectiveness of a new solution.

CyberObserverShimon Becker

Rothke rsa 2013 - the five habits of highly secure organizations

Ben Rothke

Organizations trying to balance the risk of data breaches against the cost of pervasive encryption often balk at the trade-off. The use of hardware security modules (HSMs) in conjunction with applications that perform encryption improves the protection afforded to encryption keys and the encryption processes themselves, but cost considerations typically limit the scope of their deployment. This slidedeck provides an explanation of criteria to help organizations decide which applications or data would benefit most from hardware-based encryption and key protection. The criteria are designed to make those decisions repeatable, consistent, and specific for any application, based on the organization’s sensitivity to cost, risk tolerance, and performance requirements. Real-world examples are also included! Our why not listen to the webcast: https://www.thales-esecurity.com/knowledge-base/webcasts/sans-webcast

Symantec Endpoint Protection

Symantec

Securing your presence at the perimeter

Ben Rothke

SANS Report: The State of Security in Control Systems Today

SurfWatch Labs

Epsilon_Five_Key_Errors_Booklet_A5_16pp-LRAndrea Baratta

Rothke rsa 2013 - deployment strategies for effective encryption

Ben Rothke

What could possibly go wrong? Security in Magento Shops

Andreas von Studnitz

Certificate_2Joseph Francis Cruz

Protecting application delivery without network security blind spots

Thales e-Security

SSL/TLS is extensively used to protect web traffic, but the technology can also be exploited to create security blind spots. SSL/TLS encrypted tunnels can be used to hide malicious codes and other threats from network security and performance monitoring tools. To prevent possible malware propagation across networks requires decrypt/encrypt capabilities that enable careful traffic monitoring and inspection. Don Laursen, Sr. Product Manager from F5 and Juan Asenjo, Sr. Partner Manager at Thales e-Security, explain how a security architecture using application delivery controllers (ADCs) and hardware security modules (HSMs) can ensure you can optimizes web services with traffic inspection, while safeguarding and managing the critical cryptographic keys that underpin security. Or why not listen to the webcast: https://www.thales-esecurity.com/knowledge-base/webcasts/protecting-application-delivery-without-network-security-blind-spots

LoginCat - Zero Trust Integrated Cybersecurity

Rohit Kapoor

Rothke rsa 2012 what happens in vegas goes on youtube using social networks...

Ben Rothke

Best Practices for Multi-Factor Authentication: Delivering Stronger Security ...

Sirius

Last year, the impacts of the WannaCry, NotPetya, and Equifax cyber attacks were closely followed by the stunning disclosure of the Meltdown and Spectre vulnerabilities, increasing the sense of urgency around cybersecurity and driving spending higher than ever before. Despite increased spending on security products and services, the number of data breaches continues to rise. Funding doesn’t guarantee successful security. Organizations often waste valuable resources on practices that fail to protect against evolving threats, and continue to prop up password security. View to learn: • Why the latest version of the CIS Controls has removed all references to passwords • How multi-factor authentication (MFA) can make access hard for hackers, but easy for users • The advantage of risk-based authentication mechanisms • Best practices for avoiding MFA implementation pitfalls

Appsecurity, win or loose

Bjørn Sloth

Paul Malone of TSSG spoke at the IERC debate entitled “The Internet of Energy...

Walton Institute

The International Energy Research Centre held their 2015 conference in Cork on Wednesday 13th May. The International Energy Research Centre (IERC) (http://www.ierc.ie/) is an industry led, world-leading, collaborative programme of research and innovation in integrated sustainable energy system technologies. The yearly conference brings together members from the energy industry, policy makers as well as academic researchers within the energy domain to discuss emerging trends and examine medium- and long-term future trends within the domain. Paul Malone of TSSG spoke at the IERC debate entitled “The Internet of Energy Things will deliver a Secure, Cheap and Sustainable Energy Future”.

Internet of Energy Things IERC 2015

Paul Malone

Tb mobile office presentationDorothy Davis

Ethernautics, Inc - Database Cyber Security Threats

Michael W. Meissner, RCDD

Top tips for protecting your business online (updated) Feb 14

Vanguard Visions

Web Application Firewall - Web Application & Web Services Security integrated...

Thomas Malmberg

Symantec Data Loss Prevention 9

Ariel Martin Beliera

TLS 1.3’s Fourth Anniversary:What Have We Learned About Implementation and N...

Enterprise Management Associates

In 2018, EMA surveyed IT practitioners and technology decision-makers to gauge their awareness of the TLS 1.3 standard for network encryption. In 2022, EMA revisited the adoption of the TLS 1.3 standard by going back to IT networking professionals, security experts, and business leaders to discover what they have learned throughout the implementation process and the benefits they gained through their adoption and usage. These slides, based on the webinar presented by Christopher Steffen, managing research director for security and risk management at leading IT research firm EMA, cover some of the findings from this study.

festival ICT 2013: La consumerizzazione dell’IT: come coglierne i vantaggi ec...festival ICT 2016

What's hot

Decision criteria and analysis for hardware-based encryption

Thales e-Security

Symantec Endpoint Protection

Symantec

Securing your presence at the perimeter

Ben Rothke

SANS Report: The State of Security in Control Systems Today

SurfWatch Labs

Epsilon_Five_Key_Errors_Booklet_A5_16pp-LRAndrea Baratta

Rothke rsa 2013 - deployment strategies for effective encryption

Ben Rothke

What could possibly go wrong? Security in Magento Shops

Andreas von Studnitz

Certificate_2Joseph Francis Cruz

Protecting application delivery without network security blind spots

Thales e-Security

LoginCat - Zero Trust Integrated Cybersecurity

Rohit Kapoor

Rothke rsa 2012 what happens in vegas goes on youtube using social networks...

Ben Rothke

Best Practices for Multi-Factor Authentication: Delivering Stronger Security ...

Sirius

What's hot (12)

Decision criteria and analysis for hardware-based encryption

Symantec Endpoint Protection

Securing your presence at the perimeter

SANS Report: The State of Security in Control Systems Today

Epsilon_Five_Key_Errors_Booklet_A5_16pp-LR

Rothke rsa 2013 - deployment strategies for effective encryption

What could possibly go wrong? Security in Magento Shops

Certificate_2

Protecting application delivery without network security blind spots

LoginCat - Zero Trust Integrated Cybersecurity

Rothke rsa 2012 what happens in vegas goes on youtube using social networks...

Best Practices for Multi-Factor Authentication: Delivering Stronger Security ...

Similar to Mobile application (in)security - 2nd Integrity Smart Executive Breakfast

Appsecurity, win or loose

Bjørn Sloth

Paul Malone of TSSG spoke at the IERC debate entitled “The Internet of Energy...

Walton Institute

Internet of Energy Things IERC 2015

Paul Malone

Tb mobile office presentationDorothy Davis

Ethernautics, Inc - Database Cyber Security Threats

Michael W. Meissner, RCDD

Top tips for protecting your business online (updated) Feb 14

Vanguard Visions

Web Application Firewall - Web Application & Web Services Security integrated...

Thomas Malmberg

Symantec Data Loss Prevention 9

Ariel Martin Beliera

TLS 1.3’s Fourth Anniversary:What Have We Learned About Implementation and N...

Enterprise Management Associates

festival ICT 2013: La consumerizzazione dell’IT: come coglierne i vantaggi ec...festival ICT 2016

Forecast odcau7 100_ak2Open Data Center Alliance

Presentation topic for Philippines SAP user group forum

William Ho (何添福)

Cite conference intralinks_industrialization_or_consumerization_finalIntralinks

Preventing Data Cloud Breaches with Zero Trust

Sara Goodison

Large profile data breaches have become a part of our daily reality. Shouldn't the move to the data cloud make organizations more secure? Turns out, making sense of the who, what, where, and how of data use is only getting more complex. Join us to learn about how to protect your data with Zero Trust Architecture. We'll cover the common security mistakes organizations make in the data cloud, and the tactics that attackers use to take advantage of them. By the end of the session, you'll learn new approaches that help your security or DevOps teams observe, control, and protect data.

Webinar - Mobile Security Trends

Bitglass

The Borderless Enterprise: Adapting Network Management to Mobility, Cloud, & ...

Enterprise Management Associates

The borders of enterprise network infrastructure are porous at best. It’s too late to close them, and it’s probably best that you don’t. Cloud services, mobility, and technology adopted by lines-of-business (also known as shadow IT) may erode much of the control you once had over your infrastructure, but your business is using these technologies for a reason. They get the job done. What you need to do is gain as much visibility and management as possible over these networks and services. The Borderless Enterprise enables this transformation. These slides - based on the webinar featuring Shamus McGillicuddy, research director at Enterprise Management Associates (EMA), Doug Roberts, director of products at Fluke Networks, and Mike Pennacchi, owner and lead network analyst at Network Protocol Specialists - cover: - How enterprise IT organizations are succeeding with these new technologies - Real-world examples of how IT can be an enabler and a partner in this new era - Insights from new EMA research on the borderless enterprise

Monitoring security in the externalised organisation (Auscert 2013)

Huntsman Security

Mobile (in)security ?

Cláudio André

Mobile (in)security? @ Mobile Edge '14

Mobile Edge Event

Cybersecurity During the COVID Era

Citrin Cooperman

Similar to Mobile application (in)security - 2nd Integrity Smart Executive Breakfast (20)

Appsecurity, win or loose

Paul Malone of TSSG spoke at the IERC debate entitled “The Internet of Energy...

Internet of Energy Things IERC 2015

Tb mobile office presentation

Ethernautics, Inc - Database Cyber Security Threats

Top tips for protecting your business online (updated) Feb 14

Web Application Firewall - Web Application & Web Services Security integrated...

Symantec Data Loss Prevention 9

TLS 1.3’s Fourth Anniversary:What Have We Learned About Implementation and N...

festival ICT 2013: La consumerizzazione dell’IT: come coglierne i vantaggi ec...

Forecast odcau7 100_ak2

Presentation topic for Philippines SAP user group forum

Cite conference intralinks_industrialization_or_consumerization_final

Preventing Data Cloud Breaches with Zero Trust

Webinar - Mobile Security Trends

The Borderless Enterprise: Adapting Network Management to Mobility, Cloud, & ...

Monitoring security in the externalised organisation (Auscert 2013)

Mobile (in)security ?

Mobile (in)security? @ Mobile Edge '14

Cybersecurity During the COVID Era

More from Cláudio André

Droidstat-X, Android Applications Security Analyser Xmind Generator

Cláudio André

This is the secure droid you are looking for

Cláudio André

Is my app secure?

Cláudio André

Talk given in Bsides Lisbon 2015 by me and Herman Duarte. Based on our experience on testing mobile applications, both on Android and iOS, we challenged ourselves on doing an assessment of both app stores' applications, using OWASP mobile top 10 as a reference in terms of vulnerabilities to search for. As a criteria for choosing the apps to test, we focused on the most common mobile applications available in the Portuguese Android and iOS app stores, from several categories such as finance, social media, medical and security. For this talk we expect to highlight the most interesting design choices both good and bad and what should be done to avoid such mistakes.

A day in the life of a pentester

Cláudio André

Hacker, you shall not pass!

Cláudio André

Pentesting Android Applications

Cláudio André

More from Cláudio André (6)

Droidstat-X, Android Applications Security Analyser Xmind Generator

This is the secure droid you are looking for

Is my app secure?

A day in the life of a pentester

Hacker, you shall not pass!

Pentesting Android Applications

Recently uploaded

Assuring Contact Center Experiences for Your Customers With ThousandEyes

ThousandEyes

Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...

Thierry Lestable

LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...

DanBrown980551

Do you want to learn how to model and simulate an electrical network from scratch in under an hour? Then welcome to this PowSyBl workshop, hosted by Rte, the French Transmission System Operator (TSO)! During the webinar, you will discover the PowSyBl ecosystem as well as handle and study an electrical network through an interactive Python notebook. PowSyBl is an open source project hosted by LF Energy, which offers a comprehensive set of features for electrical grid modelling and simulation. Among other advanced features, PowSyBl provides: - A fully editable and extendable library for grid component modelling; - Visualization tools to display your network; - Grid simulation tools, such as power flows, security analyses (with or without remedial actions) and sensitivity analyses; The framework is mostly written in Java, with a Python binding so that Python developers can access PowSyBl functionalities as well. What you will learn during the webinar: - For beginners: discover PowSyBl's functionalities through a quick general presentation and the notebook, without needing any expert coding skills; - For advanced developers: master the skills to efficiently apply PowSyBl functionalities to your real-world scenarios.

Essentials of Automations: Optimizing FME Workflows with Parameters

Safe Software

Are you looking to streamline your workflows and boost your projects’ efficiency? Do you find yourself searching for ways to add flexibility and control over your FME workflows? If so, you’re in the right place. Join us for an insightful dive into the world of FME parameters, a critical element in optimizing workflow efficiency. This webinar marks the beginning of our three-part “Essentials of Automation” series. This first webinar is designed to equip you with the knowledge and skills to utilize parameters effectively: enhancing the flexibility, maintainability, and user control of your FME projects. Here’s what you’ll gain: - Essentials of FME Parameters: Understand the pivotal role of parameters, including Reader/Writer, Transformer, User, and FME Flow categories. Discover how they are the key to unlocking automation and optimization within your workflows. - Practical Applications in FME Form: Delve into key user parameter types including choice, connections, and file URLs. Allow users to control how a workflow runs, making your workflows more reusable. Learn to import values and deliver the best user experience for your workflows while enhancing accuracy. - Optimization Strategies in FME Flow: Explore the creation and strategic deployment of parameters in FME Flow, including the use of deployment and geometry parameters, to maximize workflow efficiency. - Pro Tips for Success: Gain insights on parameterizing connections and leveraging new features like Conditional Visibility for clarity and simplicity. We’ll wrap up with a glimpse into future webinars, followed by a Q&A session to address your specific questions surrounding this topic. Don’t miss this opportunity to elevate your FME expertise and drive your projects to new heights of efficiency.

Bits & Pixels using AI for Good.........

Alison B. Lowndes

GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...

James Anderson

Effective Application Security in Software Delivery lifecycle using Deployment Firewall and DBOM The modern software delivery process (or the CI/CD process) includes many tools, distributed teams, open-source code, and cloud platforms. Constant focus on speed to release software to market, along with the traditional slow and manual security checks has caused gaps in continuous security as an important piece in the software supply chain. Today organizations feel more susceptible to external and internal cyber threats due to the vast attack surface in their applications supply chain and the lack of end-to-end governance and risk management. The software team must secure its software delivery process to avoid vulnerability and security breaches. This needs to be achieved with existing tool chains and without extensive rework of the delivery processes. This talk will present strategies and techniques for providing visibility into the true risk of the existing vulnerabilities, preventing the introduction of security issues in the software, resolving vulnerabilities in production environments quickly, and capturing the deployment bill of materials (DBOM). Speakers: Bob Boule Robert Boule is a technology enthusiast with PASSION for technology and making things work along with a knack for helping others understand how things work. He comes with around 20 years of solution engineering experience in application security, software continuous delivery, and SaaS platforms. He is known for his dynamic presentations in CI/CD and application security integrated in software delivery lifecycle. Gopinath Rebala Gopinath Rebala is the CTO of OpsMx, where he has overall responsibility for the machine learning and data processing architectures for Secure Software Delivery. Gopi also has a strong connection with our customers, leading design and architecture for strategic implementations. Gopi is a frequent speaker and well-known leader in continuous delivery and integrating security into software delivery.

FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf

FIDO Alliance

AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...

Product School

Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality

Inflectra

In this insightful webinar, Inflectra explores how artificial intelligence (AI) is transforming software development and testing. Discover how AI-powered tools are revolutionizing every stage of the software development lifecycle (SDLC), from design and prototyping to testing, deployment, and monitoring. Learn about: • The Future of Testing: How AI is shifting testing towards verification, analysis, and higher-level skills, while reducing repetitive tasks. • Test Automation: How AI-powered test case generation, optimization, and self-healing tests are making testing more efficient and effective. • Visual Testing: Explore the emerging capabilities of AI in visual testing and how it's set to revolutionize UI verification. • Inflectra's AI Solutions: See demonstrations of Inflectra's cutting-edge AI tools like the ChatGPT plugin and Azure Open AI platform, designed to streamline your testing process. Whether you're a developer, tester, or QA professional, this webinar will give you valuable insights into how AI is shaping the future of software delivery.

UiPath Test Automation using UiPath Test Suite series, part 3

DianaGray10

Connector Corner: Automate dynamic content and events by pushing a button

DianaGray10

Here is something new! In our next Connector Corner webinar, we will demonstrate how you can use a single workflow to: Create a campaign using Mailchimp with merge tags/fields Send an interactive Slack channel message (using buttons) Have the message received by managers and peers along with a test email for review But there’s more: In a second workflow supporting the same use case, you’ll see: Your campaign sent to target colleagues for approval If the “Approve” button is clicked, a Jira/Zendesk ticket is created for the marketing design team But—if the “Reject” button is pushed, colleagues will be alerted via Slack message Join us to learn more about this new, human-in-the-loop capability, brought to you by Integration Service connectors. And... Speakers: Akshay Agnihotri, Product Manager Charlie Greenberg, Host

FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf

FIDO Alliance

Designing Great Products: The Power of Design and Leadership by Chief Designe...

Product School

Mission to Decommission: Importance of Decommissioning Products to Increase E...

Product School

From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...

Product School

State of ICS and IoT Cyber Threat Landscape Report 2024 preview

Prayukth K V

The IoT and OT threat landscape report has been prepared by the Threat Research Team at Sectrio using data from Sectrio, cyber threat intelligence farming facilities spread across over 85 cities around the world. In addition, Sectrio also runs AI-based advanced threat and payload engagement facilities that serve as sinks to attract and engage sophisticated threat actors, and newer malware including new variants and latent threats that are at an earlier stage of development. The latest edition of the OT/ICS and IoT security Threat Landscape Report 2024 also covers: State of global ICS asset and network exposure Sectoral targets and attacks as well as the cost of ransom Global APT activity, AI usage, actor and tactic profiles, and implications Rise in volumes of AI-powered cyberattacks Major cyber events in 2024 Malware and malicious payload trends Cyberattack types and targets Vulnerability exploit attempts on CVEs Attacks on counties – USA Expansion of bot farms – how, where, and why In-depth analysis of the cyber threat landscape across North America, South America, Europe, APAC, and the Middle East Why are attacks on smart factories rising? Cyber risk predictions Axis of attacks – Europe Systemic attacks in the Middle East Download the full report from here: https://sectrio.com/resources/ot-threat-landscape-reports/sectrio-releases-ot-ics-and-iot-security-threat-landscape-report-2024/

PCI PIN Basics Webinar from the Controlcase Team

ControlCase

How world-class product teams are winning in the AI era by CEO and Founder, P...

Product School

GraphRAG is All You need? LLM & Knowledge Graph

Guy Korland

Guy Korland, CEO and Co-founder of FalkorDB, will review two articles on the integration of language models with knowledge graphs. 1. Unifying Large Language Models and Knowledge Graphs: A Roadmap. https://arxiv.org/abs/2306.08302 2. Microsoft Research's GraphRAG paper and a review paper on various uses of knowledge graphs: https://www.microsoft.com/en-us/research/blog/graphrag-unlocking-llm-discovery-on-narrative-private-data/

Neuro-symbolic is not enough, we need neuro-*semantic*

Frank van Harmelen

Neuro-symbolic (NeSy) AI is on the rise. However, simply machine learning on just any symbolic structure is not sufficient to really harvest the gains of NeSy. These will only be gained when the symbolic structures have an actual semantics. I give an operational definition of semantics as “predictable inference”. All of this illustrated with link prediction over knowledge graphs, but the argument is general.

Recently uploaded (20)

Assuring Contact Center Experiences for Your Customers With ThousandEyes

Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...

LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...

Essentials of Automations: Optimizing FME Workflows with Parameters

Bits & Pixels using AI for Good.........

GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...

FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf

AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...

Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality

UiPath Test Automation using UiPath Test Suite series, part 3

Connector Corner: Automate dynamic content and events by pushing a button

FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf

Designing Great Products: The Power of Design and Leadership by Chief Designe...

Mission to Decommission: Importance of Decommissioning Products to Increase E...

From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...

State of ICS and IoT Cyber Threat Landscape Report 2024 preview

PCI PIN Basics Webinar from the Controlcase Team

How world-class product teams are winning in the AI era by CEO and Founder, P...

GraphRAG is All You need? LLM & Knowledge Graph

Neuro-symbolic is not enough, we need neuro-*semantic*

Mobile application (in)security - 2nd Integrity Smart Executive Breakfast

1. 1 30 / 04 / 2015 /// Mobile Application (In) Security Cláudio André Herman Duarte

2. 2 • Enquadramento • Componentes de uma Mobile App • OWASP Mobile Top 10 • Exemplos práticos • Impacto no Negócio • Como proteger o ecossistema • Q&A /// Agenda 2

3. 3 /// Quem é o seu melhor amigo ? 3

4. 4 4

5. 5 /// Foi em tempos 5

6. 6 6

7. 7 7

8. 8 8

9. 9 9

10. 1010

11. 11 Cliente 11

12. 1212 Rede

13. 1313 Servidor

14. 1414

15. 1515

16. 1616

17. 1717

18. 1818

19. 1919

20. 2020

21. 2121

22. 2222

23. 2323

24. 2424

25. 25 /// M2 - Insecure Data Storage 25

26. 2626 /// M4 - Unintended Data Leakage

27. 2727 /// M6 - Broken Cryptography

28. 2828 /// M7 - Client Side Injection

29. 2929 /// M10 - Lack of Binary Protections

30. 3030 /// M10 - Lack of Binary Protections

31. 3131 /// Impacto no Negócio

32. 3232 /// Impacto no Negócio Data Leakage

33. 3333 /// Impacto no Negócio Data Leakage Financial data compromise

34. 3434 /// Impacto no Negócio Data Leakage Identity Theft Financial data compromise

35. 3535 /// Impacto no Negócio Data Leakage Identity Theft Fraud Financial data compromise

36. 3636 /// Impacto no Negócio Data Leakage Identity Theft Fraud Reputation Damage Financial data compromise

37. 3737 /// Impacto no Negócio Data Leakage Identity Theft Fraud Reputation Damage Financial data compromise PCI Violations

38. 3838 /// Como proteger o Ecossistema

39. 39 Defense-In-Depth 39 /// Como proteger o Ecossistema

40. 40 Defense-In-Depth 40 Developer Awareness and Training /// Como proteger o Ecossistema

41. 41 Defense-In-Depth Secure Development Best Practises (OWASP) 41 Developer Awareness and Training /// Como proteger o Ecossistema

42. 42 Defense-In-Depth Secure Development Best Practises (OWASP) Threat Modeling 42 Developer Awareness and Training /// Como proteger o Ecossistema

43. 43 Defense-In-Depth Secure Development Best Practises (OWASP) Threat Modeling Continuous Penetration Testing 43 Developer Awareness and Training /// Como proteger o Ecossistema

44. 44 Questões ? 44

Mobile application (in)security - 2nd Integrity Smart Executive Breakfast

Recommended

Recommended

More Related Content

What's hot

What's hot (12)

Similar to Mobile application (in)security - 2nd Integrity Smart Executive Breakfast

Similar to Mobile application (in)security - 2nd Integrity Smart Executive Breakfast (20)

More from Cláudio André

More from Cláudio André (6)

Recently uploaded

Recently uploaded (20)

Mobile application (in)security - 2nd Integrity Smart Executive Breakfast