Managing security in an online business can be a difficult enough proposition. There are often infected computers, spoof sites dedicated to stealing traffic to get user credentials, and denial of service attacks. It’s no surprise that mobile apps that connect to the cloud can also be a severe target for malicious hackers. There are however a lot of things that software developers can do to prevent their mobile apps from becoming compromised. Cloud app security is much more important than we think.

Mobile apps

Mobile apps can’t be as easily compromised by creating spoof sites, as these apps publish via an “app store.” However, it’s still possible to make a pretty convincing knock-off that will fool unsuspecting users. There are a few things you can do to prevent this kind of social-engineering type of attack.

Namely, you should make sure that all of your mobile apps are distinctly branded with your company name (or the name that apps brand with) and do not vary this name. Don’t let the marketing department claim that a new name is going to give the entire company’s product line a fresh breath of life. It’s going to merely make users confused when the product changes names, and get users ready for a name change which is an entirely bogus product. If the name is horrible and it’s not gained any market traction, then, by all means, go ahead and change it.

Software Packages

Some people will invariably jailbreak their mobile devices, to get away from the requirement that they purchase all of their software from an app store. Quite often, there are some handy software packages that users can’t live without. But, it does open up a straightforward pathway for their mobile devices to become infected with viruses, just like their personal computers. There isn’t a whole lot you can do if a user downloads a keylogger, as their username and password will invariably be stolen. However, you can mitigate some of the damage that malicious users can do. The primary way of achieving this is by having a log-based file system for user directories in your server infrastructure. It will allow for user files to roll back to a previous time. This is useful as a contingency plan for more than just a simple user getting his or her account compromised.

That’s all well and good for mitigation, but you want to make sure you are running on a secure platform.

Use tried and true methods of authentication and encryption, such as TLS and SSL. Don’t use plaintext authentication, even for a web based system that’s supposed to be used on a PC. Don’t use well-known insecure protocols such as FTP, and heavily research any special network protocol you are using.

HTTPS and SSH/SCP

HTTPS and SSH/SCP support the most potent forms of encryption that you will find. You might think you should use an IRC chat server for multi-user communication. However, IRC has plaintext authentication. And users tend reusing passwords. That means anyone can listen in on a connection and obtain user credentials.

All of these methods are effective ways of deterring a compromise, but they don’t stand alone. Sometimes, you will indeed have to react to a security compromise, and you should prepare for any disaster. That’s why damage mitigation is so significant, and systems such as log-based file systems can be some of the most powerful tools. But you don’t want to have to spend the time and money to recover from a hacker attack. So, make sure you use proper authentication and encryption, hang on to a recognized brand, and provide user interaction to build trust with customers.

Photo credit Flickr / FutUndBeidl