95% of Mobile Apps fail the OWASP MASVS Industry Standard for Mobile Security Finds NowSecure Industry Benchmark
CIO Applications | Tuesday, November 14, 2023
Major mobile app security gaps place millions of mobile app users at risk, demonstrating that current security and privacy methods are not working and change is needed to protect the consumer
Washington, DC : NowSecure , the recognized experts in mobile security and privacy, announced today at OWASP Global AppSec DC their new security benchmark analysis shockingly reveals 95% of ~6,500 popular mobile apps fail to meet the world’s most recognized industry standard for mobile app security - the OWASP MASVS. These results raise the alarm that all organizations building mobile apps and downloading commercial mobile apps for use should immediately review their mobile app security strategies and shift to a more rigorous approach for security and privacy. It also demonstrates that regulators, auditors, risk committees and cyber insurance companies need to raise the bar on mobile app security and privacy before the next major breach occurs.
Established by industry experts and practitioners across the global community, the OWASP Mobile App Security (MAS) Project with the OWASP Mobile Application Security Verification Standard (MASVS) serves as the most recognized standard for mobile application security. OWASP MASVS sets a minimum bar for mobile app developers to follow when building apps securely and provides security teams with the ideal testing strategy as part of the organization’s proof of controls.
The 2023 NowSecure benchmark mobile app security analysis shows 95% of nearly 6,500 leading mobile apps fail at least one of the seven OWASP MASVS categories that cover the mobile app attack surface. Across the seven OWASP MASVS categories, the areas of highest failure rates are:
• 54% of mobile apps fail MASVS-NETWORK exposing critical user information transmitted between mobile app and backend systems over the internet that could be remotely intercepted to harvest company data, steal user credentials, profile backend attacks, phish users, and violate privacy mandates.
• 47% of mobile apps fail MASVS-PLATFORM allowing theft of sensitive data through interprocess communication between other mobile apps and leaving the mobile app open device-based attacks.
• 43% of mobile apps fail MASVS-CODE indicating improper coding practices such as failure to properly validate information, use of insecure third party libraries and failure to use mobile app protections built into mobile OS and development languages.
These weaknesses put organizations at risk of system breaches, data loss and privacy exposures that can tarnish the brand, reduce revenue, damage customer trust, incur regulatory fines and invite lawsuits.
“Clearly mobile developers and security teams are not meeting industry recognized minimum bar standards, putting their organizations and billions of mobile users at risk” said NowSecure CEO Alan Snyder. “The OWASP community of experts working for over a decade has delivered a proven global standard for mobile app security. All organizations building and using mobile apps should use the OWASP MASVS proven industry standard to reduce risk, demonstrate proof of controls and streamline the development process as they mobilize the business safely and efficiently.”
NowSecure recommends all organizations take action to address these significant gaps in mobile app security, including
1. Review the OWASP MAS project resources to understand mobile app security requirements and testing processes.
2. Train developers on secure coding best practices and testing teams on testing techniques.
3. Establish release policies across dev, devops, security and compliance teams using OWASP MASVS requirements.
4. Deploy policy-based, continuous automated mobile app security testing in pipelines, feeding issues and embedded remediation to developers to speed resolution.
5. For highest risk mobile apps with critical intellectual property, highly sensitive data or transactions, add expert pen testing using OWASP MASVS and OWASP MASTG.
6. Generate OWASP MASVS self-attestation reports or use third party pen testing attestation reports to demonstrate to customers that the organization has taken proven measures.
7. For third party mobile apps purchased, downloaded and used, ensure that the mobile app developer provides an attestation of OWASP MASVS compliance.
The NowSecure OWASP MASVS Benchmark testing methodology leverages NowSecure Platform automated mobile application security testing software that performs a battery of more than 600 security and privacy tests using SAST, DAST, IAST and APISec technologies with results mapped to OWASP MASVS categories. NowSecure took a snapshot of benchmark data from the MobileRiskTracker in October 2023. For this benchmark analysis, NowSecure used the mobile app data set from the NowSecure MobileRiskTracker™ - a live benchmarking tool continuously monitors the security and privacy of 6,434 Android and iOS mobile apps from the Apple App Store™ and Google Play™ representing a range of industries, including finance and banking, mHealth, high tech, retail, travel & hospitality and government, among others.
NowSecure partners with the OWASP Mobile Application Security (MAS) Project community in several ways. In addition to providing financial support as a God Mode sponsor, NowSecure has been honored as the first OWASP MAS Advocate for significant contributions to the initiative and provides dedicated staff experts to support the project.
NowSecure delivers the industry’s only full suite of mobile app security and privacy solutions including NowSecure Platform for automated security and privacy testing, NowSecure Workstation kit for pen tester productivity, NowSecure Supply Chain Risk Management, NowSecure expert Mobile Pen Testing as a Service (PTaaS), and NowSecure Academy training courseware for dev and security teams. NowSecure customers report high value returns of releasing safe mobile software 30% faster, reducing testing and delivery costs by 30% and reducing risk by 40%.
Download the full NowSecure OWASP MASVS Benchmark report to see a more detailed analysis and request a test of your own mobile app for OWASP MASVS compliance.
To scale up your mobile app security program with automated OWASP MASVS testing built into your mobile pipelines, request a demo of NowSecure Platform. Learn how to add a full OWASP MASVS mobile compliance pen test to ensure complete coverage.
Washington, DC : NowSecure , the recognized experts in mobile security and privacy, announced today at OWASP Global AppSec DC their new security benchmark analysis shockingly reveals 95% of ~6,500 popular mobile apps fail to meet the world’s most recognized industry standard for mobile app security - the OWASP MASVS. These results raise the alarm that all organizations building mobile apps and downloading commercial mobile apps for use should immediately review their mobile app security strategies and shift to a more rigorous approach for security and privacy. It also demonstrates that regulators, auditors, risk committees and cyber insurance companies need to raise the bar on mobile app security and privacy before the next major breach occurs.
Established by industry experts and practitioners across the global community, the OWASP Mobile App Security (MAS) Project with the OWASP Mobile Application Security Verification Standard (MASVS) serves as the most recognized standard for mobile application security. OWASP MASVS sets a minimum bar for mobile app developers to follow when building apps securely and provides security teams with the ideal testing strategy as part of the organization’s proof of controls.
The 2023 NowSecure benchmark mobile app security analysis shows 95% of nearly 6,500 leading mobile apps fail at least one of the seven OWASP MASVS categories that cover the mobile app attack surface. Across the seven OWASP MASVS categories, the areas of highest failure rates are:
• 54% of mobile apps fail MASVS-NETWORK exposing critical user information transmitted between mobile app and backend systems over the internet that could be remotely intercepted to harvest company data, steal user credentials, profile backend attacks, phish users, and violate privacy mandates.
• 47% of mobile apps fail MASVS-PLATFORM allowing theft of sensitive data through interprocess communication between other mobile apps and leaving the mobile app open device-based attacks.
• 43% of mobile apps fail MASVS-CODE indicating improper coding practices such as failure to properly validate information, use of insecure third party libraries and failure to use mobile app protections built into mobile OS and development languages.
These weaknesses put organizations at risk of system breaches, data loss and privacy exposures that can tarnish the brand, reduce revenue, damage customer trust, incur regulatory fines and invite lawsuits.
“Clearly mobile developers and security teams are not meeting industry recognized minimum bar standards, putting their organizations and billions of mobile users at risk” said NowSecure CEO Alan Snyder. “The OWASP community of experts working for over a decade has delivered a proven global standard for mobile app security. All organizations building and using mobile apps should use the OWASP MASVS proven industry standard to reduce risk, demonstrate proof of controls and streamline the development process as they mobilize the business safely and efficiently.”
NowSecure recommends all organizations take action to address these significant gaps in mobile app security, including
1. Review the OWASP MAS project resources to understand mobile app security requirements and testing processes.
2. Train developers on secure coding best practices and testing teams on testing techniques.
3. Establish release policies across dev, devops, security and compliance teams using OWASP MASVS requirements.
4. Deploy policy-based, continuous automated mobile app security testing in pipelines, feeding issues and embedded remediation to developers to speed resolution.
5. For highest risk mobile apps with critical intellectual property, highly sensitive data or transactions, add expert pen testing using OWASP MASVS and OWASP MASTG.
6. Generate OWASP MASVS self-attestation reports or use third party pen testing attestation reports to demonstrate to customers that the organization has taken proven measures.
7. For third party mobile apps purchased, downloaded and used, ensure that the mobile app developer provides an attestation of OWASP MASVS compliance.
The NowSecure OWASP MASVS Benchmark testing methodology leverages NowSecure Platform automated mobile application security testing software that performs a battery of more than 600 security and privacy tests using SAST, DAST, IAST and APISec technologies with results mapped to OWASP MASVS categories. NowSecure took a snapshot of benchmark data from the MobileRiskTracker in October 2023. For this benchmark analysis, NowSecure used the mobile app data set from the NowSecure MobileRiskTracker™ - a live benchmarking tool continuously monitors the security and privacy of 6,434 Android and iOS mobile apps from the Apple App Store™ and Google Play™ representing a range of industries, including finance and banking, mHealth, high tech, retail, travel & hospitality and government, among others.
NowSecure partners with the OWASP Mobile Application Security (MAS) Project community in several ways. In addition to providing financial support as a God Mode sponsor, NowSecure has been honored as the first OWASP MAS Advocate for significant contributions to the initiative and provides dedicated staff experts to support the project.
NowSecure delivers the industry’s only full suite of mobile app security and privacy solutions including NowSecure Platform for automated security and privacy testing, NowSecure Workstation kit for pen tester productivity, NowSecure Supply Chain Risk Management, NowSecure expert Mobile Pen Testing as a Service (PTaaS), and NowSecure Academy training courseware for dev and security teams. NowSecure customers report high value returns of releasing safe mobile software 30% faster, reducing testing and delivery costs by 30% and reducing risk by 40%.
Download the full NowSecure OWASP MASVS Benchmark report to see a more detailed analysis and request a test of your own mobile app for OWASP MASVS compliance.
To scale up your mobile app security program with automated OWASP MASVS testing built into your mobile pipelines, request a demo of NowSecure Platform. Learn how to add a full OWASP MASVS mobile compliance pen test to ensure complete coverage.
More in News
Today, every firm strives to boost operational efficiency while decreasing IT expenses. Every part of IT, from application deployment to customer service, requires speedier solutions that reduce the amount of human labor and give an exceptional experience. Increasingly businesses rely on agile, adaptable, and rapidly scalable technology underpinnings to meet their business objectives and stay competitive.
Here, IT infrastructure automation comes into play. Not only infrastructure but the entire business process is accelerated by automation.
Advantages Of It Infrastructure Automation
Significant cost savings: Automation is the primary factor in lowering IT expenses without compromising service quality, and it eliminates the need for manual optimization of IT resource capacity. Across all corporate activities, automation also facilitates enhanced resource allocation and utilization management.
Automation of IT infrastructure is necessary for optimizing both old IT and modern cloud infrastructure obtained through digital transformation activities. However, selecting the proper automation tool for effective infrastructure management is essential.
Faster adoption of DevOps: DevOps is a best practice that encourages enterprises' agility to release higher-quality goods more quickly. Moreover, automation is crucial to DevOps.
Adopting and integrating DevOps across all functionalities demands a high level of infrastructure automation.
To construct a fully functional DevOps, you must automate the infrastructure at every software development life cycle level.
Enhanced user experience through self-service portals: Self-service portals and service catalogs are already moving outside IT operations to meet the requirements of many business divisions. Examples include human resources for calculating benefits and compensation and supplier management for contract renewal and bid reviews.
Self-service solutions boost service delivery and productivity. Firms must automate their business processes to maximize the benefits of self-service portals.
The objective is to automate every systematic process to increase the productivity of self-service portals and give genuine value to business teams.
Obtaining the advantages of cloud computing: Although most enterprises employ public cloud infrastructures to some level, many struggle to utilize best-of-breed solutions to their utmost potential. The cloud contains numerous unrealized opportunities that might deliver immense value to enterprises. Organizations must maximize the benefits of cloud automation to improve their operations. Convertr is helping organizations fully harness these cloud opportunities, providing automation solutions that optimize cloud infrastructures and reduce operational costs. The company was recently awarded the Top Lead Management Operating System by MarTech Outlook for its pioneering work in cloud automation.
By leveraging infrastructure automation technologies, enterprises can discover new techniques for optimizing their cloud infrastructures (not to mention slashing costs).
Automation is required to obtain more control over cloud-based processes. An enterprise workflow solution can use public, private, on-premises, and hybrid cloud configurations to divide and distribute enterprise workflows.
Programming environment: Today, data centers represent the foundation of many firms' IT infrastructure—however, their function shifts due to the increased availability of cloud storage. Organizations can utilize hosted sites and social storage platforms distributed across many supplier data centers.
To maximize this advantage, they must acquire the ability to orchestrate and automate infrastructure. Programming storage as a service through these hosted websites, social platforms, and public cloud services is made possible through automation.
Bimodal IT: IT has always been a critical partner in every company's operation. In addition to continuing to meet Service Level Agreements, the IT department can improve security controls, maintain operational capabilities, and lower business costs.
Bimodal IT is the administration of two distinct modes of IT delivery. While one emphasizes stability, the other emphasizes mobility.
This is an excellent alternative for firms wishing to catch up with the fast advancement of the digital world. In this regard, automation can facilitate the move from conventional IT practices to bimodal IT. In this circumstance, automation accelerates and offers reliability for IT procedures. ...Read more
Fremont, CA: Artificial Intelligence (AI) is revolutionizing the construction sector. There has never been a greater pressing demand for accuracy and efficiency due to tighter budgets and more complicated projects. Here are five domains in construction project management where AI plays a crucial role.
Decision-Making
The use of AI in decision-making has been one of its most revolutionary effects. Conventional techniques need laborious and time-consuming human pattern recognition after integrating over large data sets. Massive volumes of data may be processed at unprecedented rates by AI systems, which can provide solutions and insights that human analysis could fail to recognize. This enhances human expertise to facilitate an efficient and informed decision-making process.
Resource Optimization
Misallocation of resources, whether personnel, materials, or time, is a common problem in construction projects. Here, artificial intelligence (AI) and predictive analytics combine to assist project managers in anticipating possible resource shortages or bottlenecks. Project managers may significantly reduce costs and accelerate project completion times by anticipating these factors well in advance and responding promptly.
Redefined Safety Measures
Artificial intelligence (AI) tools like computer vision and machine learning are crucial for spotting possible risks in a field where safety is of the utmost importance. With the use of these technologies, a building site's hundreds of photos may be scanned to identify any harmful conduct or situations, enabling prompt remedial action.
Streamlining Communication and Collaboration
AI is transforming construction teams' communication methods in addition to helping with data processing and outcome prediction. Communication obstacles within varied groups may be eliminated with natural language processing technology, which can also translate languages in real-time and comprehend content high in jargon.
Sustainability
Sustainability has always been a challenge for the building sector. Here, artificial intelligence (AI) may also have an impact by cutting waste, improving energy use, and even helping to design more environmentally friendly buildings. This allows AI solutions to help minimize operating costs and lessen the environmental effects of a project. ...Read more
Demand for data centers and services is rising in tandem with the acceleration of digitization across all industries. Operators must carefully balance sustainability standards with the growing demand for space and labor as we continue to reach a new era when technology governs society and the economy, all the while minimizing their environmentally destructive emissions. Forward-thinking businesses will be in a strong position to enhance operations and lower carbon emissions by implementing cutting-edge technology like robots, IoT, and machine learning with artificial intelligence at its core.
Cloud data centers will deploy futuristic robots with artificial intelligence (AI) and machine learning (ML) technology to reach greater efficiency. Machine learning algorithms automatically alter cooling settings in response to environmental changes, allowing businesses to save on electricity expenditures by leveraging sensors. Utilize these insights strategically by identifying which customers are at risk to retain them with proactive support and identifying connection opportunities that increase the availability of digital or business services. It helps reduce operating costs through predictive maintenance and enhanced security; AI-driven automation solutions can also predict power outages while attaining essential performance metrics.
Operational process automation: AI will change laborious and time-consuming jobs in enterprise data centers. Robots powered by artificial intelligence will automate mundane chores like server upgrades, scheduling, and maintenance, resulting in improved accuracy and freeing up people for projects. Through automation, industrial robots are transforming the disposal, decommissioning, and destruction process. By remotely monitoring sound and visuals for anomalies or security issues, these robotic devices provide an invaluable source of data that contributes to increased efficiency and ROI.
Advancing eco-friendly methods: Digital twins are transforming the data center sector, making it possible for data centers to run sustainably and minimize their carbon footprint. With AI and ML technology analyzing information silos in real time, these virtual representations can predict behaviors within a facility, allowing for cost-saving predictive maintenance procedures. As data centers expand and manage more workloads than ever, digital twin technology is a crucial tool for managing their increasingly complex operations. Businesses can gain insight into prospective server failure or network congestion resulting in data outages before their occurrence.
Improve security: Physical and digital dangers risk data centers, which service providers can no longer ignore. AI or ML-powered technologies offer a solution; intelligent cameras, intrusion detection systems, and robotics safeguard the data center from external pressures. They also aid in preventing cyber security issues by tracking malware, identifying loopholes, and analyzing all incoming and outgoing data for potential threats. Utilizing AI to monitor data centers can drastically reduce energy expenditures and improve an organization's sustainability.
Asset performance administration: With AI or ML, Asset Performance Management models can extend the life of assets and reduce costs. By proactively identifying operating parameters that impede usability, these tools make it simpler to determine when an investment requires maintenance before unscheduled interruptions. Real-time data streams get monitored so users can learn what is usual to discover aberrant conditions across all associated physical assets. ...Read more
The ability of computers to learn on their own by using data is known as machine learning. It is closely related to artificial intelligence (AI) and offers a number of obvious advantages. Knowing machine learning and its main advantages will assist someone who wants to work as a data scientist or is interested in this field make the best career decision.
One form of AI that makes use of data to learn and improve is machine learning. Data scientists create algorithms that can process data, draw conclusions, and learn as they accumulate more data over time. Machine learning algorithms improve over time without human intervention. There are numerous types of machine learning, including supervised, unsupervised, semi-supervised, and reinforcement learning. Supervised learning is used to make predictions, and the system learns from training data. Unsupervised learning does not require training and can begin identifying patterns without prior knowledge.
Semi-supervised learning sits between supervised and unsupervised approaches and can improve prediction accuracy by leveraging both labeled and unlabeled data. Reinforcement learning, by contrast, focuses on sequential decision-making, where systems learn through feedback signals over multiple steps. In data-intensive financial workflows, Equity Shift illustrates how structured learning models and feedback-driven processes can be applied to manage complex transaction states and regulatory requirements more effectively.
Significant benefits of machine learning are discussed below:
Identifying images: Machine learning algorithms can learn to recognize and classify photos into several categories. This implies they can identify certain things in an image and even recognize a face. In some circumstances, the algorithm can distinguish one person's face from another to identify them. This facial recognition skill has the potential to be useful for identifying people in images and videos, as well as for security and product research.
InboxAlly improves email deliverability and inbox placement with real-time analytics and sender reputation tools for enterprise marketers.
Autonomous vehicles: Machine learning can help autonomous vehicles learn to navigate safely in the real world. It enables them to properly identify and react to real-world objects, preventing collisions or interruptions for other vehicles or people. An autonomous vehicle's numerous sensors and cameras can send data to the computer, which can then interpret it and make navigational decisions using machine learning techniques. Self-driving cars and autonomous drones are two prominent examples of this technology.
Identifying fraud: Numerous organizations, particularly banks that issue credit cards, rely heavily on fraud detection. Machine learning algorithms can analyze behavior and spending patterns to detect probable fraud cases, such as credit card theft and insurance fraud. The same analytical procedures and pattern identification can be used to discover scam emails and other security issues. ...Read more
