Building and running a mobile application security programme
You move from one app to the organisation's whole mobile portfolio: inventory, risk tiering, standards and requirements, team training, metrics, managing suppliers, vulnerability disclosure and incident readiness.
Level 501 · 18 lessons · 15 practice labs
Lessons
Portfolio and risk
- The app inventory: store, in-house and forgotten apps
- Risk tiering: which assurance level for which app
- Writing the in-house mobile security standard
- The regulatory map: payment, health and personal data rules
- Maturity assessment
- Short task: sort a twelve-app portfolio into risk tiers
Process and people
- Security in the release cycle: checkpoints from design to release
- Security champions and developer training
- Apps built by agencies and suppliers: contract and acceptance
- The assessment schedule: in-house team, outside firm, automated scans
- The vulnerability disclosure channel and reward programme
- Short task: write security acceptance criteria for an app built by an agency
Measuring and readiness
- Programme metrics: time to fix, coverage, repeat findings
- Reporting to leadership
- Mobile incident readiness: fake app, leaked key, malicious SDK
- Watching the stores for lookalike apps and requesting takedown
- Short task: compute and interpret three programme metrics from the findings history
Capstone
- Capstone: write a one-year security programme plan for a municipality's mobile portfolio
Practice labs
- Find the missing fields in the app inventory: List the records with no owner or last release date.
- Sort twelve apps into risk tiers: Classify by data type and user count and assign an assurance level to each tier.
- Find the forgotten apps and propose decisions: Compare store records with the inventory and write remove-or-renew proposals for apps no longer updated.
- Mark the vague items in a draft standard: Find five items that cannot be tested.
- Write a requirement table by risk tier: Set the mandatory MASVS controls and verification frequency for three tiers.
- Write security acceptance criteria for an agency-built app: Write the delivery criteria, evidence types and rejection conditions to add to the contract.
- Compute mean time to fix from the findings history: Extract the mean for high-severity findings from the CSV.
- Compute and interpret three programme metrics: Compute time to fix, scan coverage and the repeat-finding rate.
- Prepare the quarterly report for leadership: Produce from the data a two-page report with metrics, trend and three decisions.
- Order the first steps for a leaked API key: Put rotation, usage review and release steps in order.
- Prepare a takedown request for a lookalike app: Write the request to the store with signer and package evidence attached.
- Write a tabletop exercise for a malicious SDK scenario: Prepare a one-hour exercise scenario with roles, decision points and communication texts.
- Fill in and score the maturity survey: Derive the score for five areas from the given answers.
- Prepare the assessment schedule: Plan in-house, outside firm and automated scan frequency for the portfolio within the budget.
- Write a one-year programme plan for a municipality's mobile portfolio: Deliver a plan with goals, calendar, owners and metrics for Selvikent Belediyesi.
About this course
You move from one app to the organisation's whole mobile portfolio: inventory, risk tiering, standards and requirements, team training, metrics, managing suppliers, vulnerability disclosure and incident readiness.
What you will learn
- Portfolio and risk
- Process and people
- Measuring and readiness
- Capstone
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.