5

I'm starting to introduce mobile web apps to my company but my not-so-techie boss is worried about web security issues on mobile devices.

I'm new in the mobile world but as a web developer I know the basics about web security (like the best practices listed in OWASP) but I don't know if there's anything else that could make my mobile web app vulnerable specifically for mobile web browsers.

Also, I need an internet article readable from not-so-techie bosses that could help me convince him how secure our mobile web app could be if I apply the common web security best practices.

Can you help me with this?

PS. I'm using Java as my backend and jQuery Mobile as my frontend.

Improve this question
2
  • Why do you think there will be more security issues on a mobile browser, than on a regular browser? T
    – Dofs
    Commented Jan 31, 2012 at 19:14
  • Because on a mobile browser a regular user can be less aware of attacks like Phishing, XSS, cookie stealing through public WiFi spots or man in the middle. They cannot also be sure they are going on an SSL enabled connection or what could happen with the session if they leave the page open on the mobile browser app. They are almost the same attacks someone could do on a regular web app but since the regular users have less control on the mobile browser they tend to fear. I'm just trying to find popular articles about mobile security to calm them down.
    – Roberto Linares
    Commented Feb 2, 2012 at 5:14

2 Answers 2

Reset to default
1

For blog posts, Google Online Security is perhaps a good place to start (link at the bottom). Also check out "Krebs On Security" - he's a journalist, not technical, so his standard of writing is excellent.

As I'm sure you know, being good at web security -mostly- lies in stuff like protecting against the basics and there is no substitute for having your software regularly audited and pen-tested by professionals. Preparing a rough and ready cost-benefit analysis for your boss might be useful in getting sign-off.

Krebs on Security: https://krebsonsecurity.com/

Google Online Security Blog: http://googleonlinesecurity.blogspot.com/

Improve this answer
1
  • Thanks! they seem very good and well documented blogs, so are a good place to start my search.
    – Roberto Linares
    Commented Feb 11, 2012 at 1:52
0

Your scenario has little to do with mobile web security and more to do with plain old fashioned remote access to stuff that used to be locked behind the old corporate firewall. So the same issues apply by and large. Mobile just adds some interesting wrinkles -- like spotty VPN support and higher chance of loss or theft of device.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.