openskills.info
Course catalog
Course Preview

Mobile Application Security

Mobile application security protects mobile apps, their data, and their service connections from misuse. It combines secure design, platform controls, careful data handling, and static and dynamic testing across the app, device, and backend trust boundaries.

itMobile and client application development

Mobile Application Security

Mobile application security protects a mobile app, the data it handles, and the services it calls. The work spans the app package, its runtime process, the mobile operating system, third-party libraries, network connections, and backend APIs.

The central constraint is that the app runs on a device outside the developer's control. A user or attacker can inspect the package, observe network traffic, change runtime behavior, and operate the app on a modified device. Platform sandboxes and code signing reduce risk, but they do not make client-side decisions trustworthy.

Use this mental model:

source code and dependencies
           ↓ build and sign
      installable package
           ↓ install
app sandbox ↔ platform services ↔ other apps
     ↓              ↓
local data      permissions and IPC
     ↘              ↙
        network → backend API → protected data and actions

Security controls belong at every boundary. The app minimizes and protects local data. The platform mediates access to protected resources and other apps. Transport security protects data in transit. The backend authenticates the session and authorizes every sensitive action.

Start with assets and trust boundaries

An asset is anything that needs protection. Mobile assets commonly include credentials, session tokens, personal data, cryptographic keys, paid features, proprietary algorithms, and backend operations.

Draw where each asset originates, moves, and rests. Mark transitions between the app process, operating system services, local storage, other apps, third-party software development kits, networks, and backend services. Each transition is a trust boundary because one side cannot assume the other side is safe.

A threat model connects those assets and boundaries to realistic attackers. Examples include a malicious app on the same device, a person controlling a rooted or jailbroken device, a network attacker, a repackager, and a remote user who calls the backend API without the official client.

The threat model determines assurance. An app that shows public information has different needs from an app that moves money or holds health records. OWASP Mobile Application Security Verification Standard controls provide a common baseline. OWASP Mobile Application Security Testing Guide tests explain how to verify the selected controls.

Continue the course

This section is part of the paid course.

See pricing to subscribe, or log in if you already have access.

Where this skill leads

Relevant careers

See how this topic contributes to broader role-level skill maps.

Sources