Let's discuss your Security needs!

The Questions your Business needs to Answer First

To understand why it's important for your Business to attack itself first to stay a step ahead of attackers, you need to know the answers to these questions:

• Why does your business need to think like an attacker?
• What is the security awareness level of your software engineers?
• What are the Attackers Motivations?
• Why does your business need to foster a security culture?
• Why is it important for your business to adopt a positive security mindset?
• What is the cost of a data breach for a Business's revenue?
• What is the impact of a data breach for your Brand reputation?
• How challenging will be for your Business to recover Customer Trust after a data breach?
• Can your Business survive being closed following a security incident?

You cannot skip or skim over answering any of these questions. In the next sections, I will provide you with insights on each one.

Think Like an Attacker

One of the key challenges that businesses face in securing their Mobile Apps and Mobile APIs is the ability to think like an attacker. Mastering this skill is essential to enable a Business to implement an effective Mobile API Security strategy. Otherwise, they will be more easily outpaced by attackers.

Attackers typically combine multiple techniques and chain weaknesses and vulnerabilities in Mobile Apps and their Mobile APIs to achieve their goals. If one cannot think like an attacker during the threat modeling assessment, it may overlook attack vectors, resulting in a failure to define and address them in the Mobile API Security strategy to be implemented by software engineers.

Software Engineers Security Awareness

Software engineers are typically focused on building functionality and features that meet user requirements, while also ensuring that the Mobile App and their APIs are performant and easy to use.

While Mobile API Security is certainly an important consideration, it is often not the primary focus in the developers thinking process. They may lack a deep understanding of the various security risks their Mobile App and API may face. Even if they do, they might not fully grasp how creative hackers can be in combining these security risks to mount successful attacks. Consequently, they may dismiss certain security risks as low-priority tasks, which often remain unaddressed, leaving security gaps vulnerable to exploitation by hackers.

Attackers Motivations

Attackers are motivated by factors such as financial gain, political, ideological, or social motives, or simply the challenge of exploiting vulnerabilities in Mobile Apps and their APIs.

They approach Mobile App Security and Mobile API Security from a different point of view, actively seeking out weaknesses and vulnerabilities that they can chain together to exploit Mobile Apps and their APIs for their own purposes or who they work for, that can be a criminal organization, a state or just a company trying to get ahead of their competitors.

Fostering a Security Culture

It is up to the business to cultivate a security culture across every department, not solely within the engineering department. This fosters a collaborative security environment where everyone feels empowered to suggest possible attack vectors and ways to mitigate them.

With such a culture in place, the business is prepared to conduct internal security assessments. This is because it now embodies a security culture where everyone understands that attackers think differently and have a unique perspective when examining the business's operations and how engineers have designed, implemented, and secured the software.

A Positive Security Mindset

Now that the business understands how attackers think and has fostered a security culture, they can adopt a positive security mindset where they anticipate everything and plan accordingly.

This means leaving behind the old mindset of 'this will never happen to us' or 'this is very unlikely,' as well as the notion that merely meeting compliance or legal requirements is sufficient. It also involves discarding any other excuses for neglecting security. By recognizing the importance of proactive measures, businesses can better protect themselves against potential threats.

A positive security mindset enables a Business to be better positioned to avoid and mitigate security risks and to be well-prepared to address a security breach if one occurs, despite having robust security measures in place.

Security by Default

Now that your business has adopted a positive security mindset, it should be evident that it cannot fall into the common pitfall of failing to prioritize security in projects from day zero, or to be more explicit, from the day you envision, design, and start discussing it with stakeholders.

Instead of treating security as an afterthought and implementing only what is perceived as the minimum requirements for safe software, such as adding user authentication or implementing the OWASP Top Ten for mobile APIs, or code obfuscation for mobile apps, it's important to recognize that these are just basic security steps in your journey toward a robust Mobile API Security strategy.

Your Business needs to adopt a 'security by default' posture to protect its Brand Reputation and Customer Trust in a way that avoids irreparable or very expensive damage to the Business's Revenue."

Business Revenue, Brand Reputation and Customer Trust

A security incident, whether or not it leads to a data breach, can have both short-term and long-term impacts on a business's revenue, brand reputation and customer trust. Initially, the business may need to hire security experts to mitigate the ongoing event, investigate its causes, propose changes, and implement them. These emergency measures can be extremely expensive. Additionally, the business may be forced to close or operate at reduced capacity for days, weeks, or even months.

Furthermore, the business may face substantial fines for breaching laws that require security measures to be in place, mishandling the security incident, or exposing customers' personally identifiable information. Customers may also take legal action against the business, seeking significant compensation.

Unless the business is a major player with substantial financial resources, it may struggle to afford the cumulative costs of these consequences. This could lead to bankruptcy or years of financial recovery, with no guarantee of fully regaining brand reputation and customer trust.

Your business needs to adopt strong security measures to protect against all types of attacks, including static and dynamic attacks. A multitude of solutions are available to achieve this goal, but what's crucial is adopting a 360-degree approach to security and applying it in layers, similar to how castles and prisons have been fortified for centuries.

Possible Types of Attacks

Attacks may come from many directions, sometimes from the least expected ones (Ask France about it's WWII Maginot Line, which was supposed to render a German invasion impossible), and can take the form of static, dynamic, or both. Therefore, it's important to be familiar with both types and be prepared to defend against them.

Static Attacks

A very common static attack is reverse engineering the binary of a mobile app to understand how the Mobile API is used and which credentials are required to communicate with it. The mobile app binary can be easily extracted from a mobile device or downloaded from the app store using an attacker's custom script.

A less common static attack occurs when the attacker gains access to the source code of your mobile app or API to analyze it and understand how to attack your business. This can happen through a breach in the source code repository or if the code is accidentally made public.

Dynamic Attacks

Dynamic or runtime attacks occur when the attacker uses your Mobile App on a device they control, often by circumventing the device's OS security measures through rooting or jailbreaking. This provides more opportunities to attack your Mobile App and the secure communication channel it uses to communicate with Mobile APIs. The attacker may also instrument the code and memory used by your Mobile App to modify it, circumvent security measures, or change business logic, potentially impacting your revenue, brand reputation, and customer trust.

More often than not, attackers combine both static and dynamic attacks to target the Mobile APIs used by the Mobile App. They may extract data to sell on the dark web or use it to extort your business by threatening to make it public. Additionally, attackers may exploit Mobile APIs to perform unauthorized actions such as money transactions, purchases, adding credits, and more.

Attacking Yourself First

A common methodology to attack yourself is to create Blue and Red security teams, where the Red team attacks and the Blue team defends. For example, the Red team will take the attacker role, where it attacks the mobile app statically and dinamiclly in order to succeed in attacking the Mobile API. The Blue team is the one ensuring that both the Mobile APP and and Mobile API have enough security measures in place for the Red team to fail.

APIs can also be attacked without the need to first attack the Mobile App, because a lot of security tools exist to facilitate such attacks and it's common for attackers to have such tools running 24/7 to loop all the public IP addresses available in the internet, and test the API against all known possible exploits and vulnerabilities they are interested in, therefore it's important that you also also use such tools and be creative on how you use them.

Let's Work on Your Business Security

Only after your Business has answers to all the above questions and has adopted a positive security mindset, where everyone understands how attackers think, it's then ready to establish a robust Mobile API Security strategy capable of better chances of withstanding all attacks.

Your Business will conduct assessments against it's own systems from the perspective of an attacker. This process aims to identify security gaps that need to be closed, enabling it's infrastructure to withstand real threats from attackers in the wild.

These attackers often have more resources at their disposal and are typically creative in their approaches. They may exploit unknown security flaws (zero days) in the software you use for your Mobile Apps and API backends. Therefore, it's crucial to plan accordingly and be prepared for the worst-case scenario.

If any security vendor advertises or promises you bulletproof or 100% security, then they aren't being honest with themselves or your business, because such a thing doesn't exist in security.

It's crucial that your Business internalizes that it's not a question of if a security incident will occur, but when it will happen.