MASVS Security Checklist - Mobile App Security

The MASVS Control Groups The standard is divided into various groups of controls, labeled MASVS-XXXXX, that represent the most critical areas of the mobile attack surface:  MASVS-STORAGE: Secure storage of sensitive data on a device (data-at-rest).  MASVS-CRYPTO: Cryptographic functionality us...

The MASVS Control Groups The standard is divided into various groups of controls, labeled MASVS-XXXXX, that represent the most critical areas of the mobile attack surface:  MASVS-STORAGE: Secure storage of sensitive data on a device (data-at-rest).  MASVS-CRYPTO: Cryptographic functionality used to protect sensitive data.  MASVS-AUTH: Authentication and authorization mechanisms used by the mobile app.  MASVS-NETWORK: Secure network communication between the mobile app and remote endpoints (data-in-transit).  MASVS-PLATFORM: Secure interaction with the underlying mobile platform and other installed apps.  MASVS-CODE: Security best practices for data processing and keeping the app up-to-date.  MASVS-RESILIENCE: Resilience to reverse engineering and tampering attempts.  MASVS-PRIVACY: Privacy controls to protect user privacy.  MASVS-STORAGE MASVS-STORAGE-1: Securely Store Sensitive Data Encryption at Rest: Use strong encryption algorithms like AES-256 to protect sensitive data when stored on the device. Secure Storage Locations: Utilize platform-specific secure storage solutions, such as Android Keystore or iOS Secure Enclave, for sensitive data like keys and tokens. Key Management: Store encryption keys separately from the data and protect them using hardware-backed key management systems.  MASVS-STORAGE MASVS-STORAGE-2: Prevent Leakage of Sensitive Data No Sensitive Data in Logs: Avoid logging sensitive data or exposing it in error messages or stack traces. Exclude from Unencrypted Backups: Ensure sensitive data is not included in backups unless encrypted first. Data Minimization: Store only the minimum amount of sensitive data required for the app's functionality. Secure Data Transfer: Prevent sensitive data from being stored in insecure locations or transmitted unencrypted.