Mobile Application Penetration Testing (MAPT) Datasheet

Trained Security Analysts Test for Exploitable Vulnerabilities That Could Compromise Data

As data is migrating into the cloud, and employees are becoming more mobile, business solutions become increasingly reliant on mobile applications to stay relevant. Organizations are compelled to push out mobile solutions quickly, in many cases, entrusting secure quality development to third party vendors. These mobile application developers are typically focused on producing an application that meets their clients’ needs operationally, often on short timelines. Security of the application may not be the immediate focus through the development process. Frequently, these applications capture or process sensitive employee or customer data, which may be at risk due to a lack of proper security checks.

Digital Defense’s Mobile Application Penetration Testing (MAPT) is a key component to any robust information security program where mobile applications are utilized or developed. MAPT is performed by trained security analysts and utilizes industry best practice test methodologies, and will efficiently determine if a potential vulnerability is truly exploitable and if it could lead to the compromise of sensitive corporate data.

A Multi-Phased, In-Depth Process

In conducting the MAPT service, Digital Defense will provide a point-in-time evaluation of an organization’s susceptibility to a breach or data leak by a malicious external attacker via its mobile application(s). This service involves multiple phases to provide organizations with a comprehensive assessment of the security posture of their mobile application.

Planning Phase

Digital Defense security analyst(s) will work with the client to ensure the engagement is properly scoped and determine the best methodology to test the application based on the application’s specific requirements. Open Source Intelligence and Observation will be conducted to identify exposed information regarding the application, such as code left in exposed repositories, or information posted on job boards or social media as part of application scoping. Observation of normal application functionality will be conducted to determine a baseline a behavior.

Testing Phase

Cryptographic Analysis: Analysts will observe the data in transit between the mobile application and the backend data server or API calls. The analyst will attempt to break the encryption channels being utilized through man-in-the-middle style attacks.
Code Analysis: Analysts will perform code validation to discover security flaws through several differing methodologies, based on the type of application and privileges available to the mobile app to identify weaknesses in the ways the application processes user-supplied data, as well as server-side components of the application.
Local Application Protection Analysis: Analysts will determine how well the mobile application protects against reverse engineering and application tampering that may expose application data. Testing will also be performed on the protections in place that should prevent against gaining sensitive code or information stored within the application.

Reporting Phase

Upon completion of the hands-on portion by our expert analysts, Digital Defense will provide you with a thorough report that will outline the vulnerabilities discovered within the mobile application, as well as detailed mitigations to protect your data. Finally, an informal out brief will be conducted to help understand the process, as well as the findings.

Want to Ensure Your Mobile App Dev Is Secure?

Mobile Application Penetration Testing uses trained analysts and industry best practices to unearth vulnerabilities.

Request a Quote