Security guidance ages quietly. A checklist written three years ago still reads as sensible, still passes review, and is wrong in ways that only show up when someone compares it with the source. We did that with our own article this month and found three things to correct.
The Ranking Changed
The OWASP Mobile Top 10 is the reference most audits cite. Its current edition is the 2024 release (OWASP). Our article called insecure data storage the number one risk. In the current list it is ninth. First place now belongs to Improper Credential Usage: secrets and keys that are built into the app or handled badly.
That reordering is a statement about where breaches come from. An app is delivered to the customer's device, where it can be unpacked and read. Anything compiled into it should be considered published.
The Recommended Tool Was Deprecated
For years the standard advice for protecting stored values on Android was a library class called EncryptedSharedPreferences. Its own reference page now says: "This class is deprecated. Use android.content.SharedPreferences instead" (Android). Any internal standard that still mandates it is mandating something the vendor has withdrawn.
The replacement advice is less dramatic than the deprecation. The platform already isolates each app's files: "By default, files that you create on internal storage are accessible only to your app. Android implements this protection, and it's sufficient for most applications" (Android). The stronger control is to store less.
A Control That Can Take You Offline
Certificate pinning is often listed as a requirement. The platform documentation describes it as something some apps choose, and is specific about the risk: without a backup key, a certificate change means "you must push out an update to the app to restore connectivity". A security control that can cause an outage needs an owner and a rotation calendar, or it should not be switched on.
What to Ask Your Team
- Which edition of the OWASP list does our checklist follow?
- Are any keys or secrets compiled into the app?
- Do we depend on a storage library the vendor has deprecated?
- If we pin certificates, who owns the rotation date?
-Rocky
#MobileSecurity #RiskManagement #OWASP #EngineeringDreams #StrategiaX
Originally published on ANDROID-ARCHITECT, the Android engineering blog of Strategia-X, with the configuration and code.