Insiders Guide to Mobile AppSec with OWASP MASVS

The talk is a guided tour of the OWASP Mobile Application Security Verification Standard, aimed at web security practitioners who are moving into mobile testing. It starts from the premise that a mobile app runs on a hostile, user-controlled device, so reversing and tampering should be assumed. Benchmark data from scanned app store releases is used to show that most apps carry security issues, with insecure data storage and network communication among the most frequent findings, and insecure coding and authentication also appearing often.

The middle of the session groups MASVS guidance by the sensitivity of the data an app handles. It covers keeping data off the device, avoiding sensitive values in query strings and logs, checking that certificate pinning and platform network settings are actually applied, and treating anti-tampering as added friction rather than a fix. The speaker argues for moving sensitive logic and key generation to the server, and for building apps with testability in mind so that automated tools can cover much of the security test suite. Tooling such as Frida, Radare, proxies and rooted or jailbroken test devices is mentioned as part of a practical toolkit.

The closing section covers software bill of materials work through CycloneDX, and an IoT-focused certification built from MASVS for mobile apps that talk to connected devices. The main takeaways are to threat model early, test on real devices, scrutinise third-party libraries, and use the free MASVS and MSTG resources as a starting point.