1. Mobile Application Security Testing (MAST) project Keng Lee G@apertise March 2016

2. Agenda A Glance The Mobile Application Security Testing White Paper The Following Works 2016/03 2

3. A Glance Mobile Application Security Testing (MAST) project (April, 2015) Mobile Application Security Testing White Paper Proposal (April 2015 ~ October. 2015) –Reference mobility and App security "standard" (NIST-SP800- 163, ISO 27034, OWASP, …). Execution Environment, OS, App Implantation, Data transfer are under the scope –15 meetings, 290 people joined, 620 comments –6 drafts were updated Peer review (November 2015 ~ March 2016) –50s comments and modified –2 online discussion meetings 2016/03 3

4. 5. Mobile App Vetting Process 5.1 Mobile App Vetting Scheme 5.2 Mobile App Security Items 5.2.1 Privacy Handling - Privilege Misuse 5.2.2 Privacy Handling - Improper Information Disclosure 5.2.3 Native Security - API/Library Native Risk 5.2.4 Native Security - App Collusion Activity 5.2.5 Native Security - Development Obfuscation Concern 5.2.6 Protection Requirement - Connection Encryption Strength 5.2.7 Protection Requirement - Data Storage Status 5.2.8 Execution Environment - Power Consumption Problem 5.2.9 APP Development Security Item Classification 5.3 Mobile App Management Life Cycle 5.4 Technological Vetting Process and Procedure - Basic Definition Requirements and Objectives 5.5 Technological Vetting Process and Procedure - Vetting Content Classifying and Rating 5.6 Technological Vetting Process and Procedure - Vetting Process and Flow 5.7 Management Cycle of Vetting Process and Procedure 1. Introduction 1.1 Purpose and Scope 1.2 Initial Normative References 1.3 Preliminary Study 1.4 Content Structure 2. Mobile Apps Vetting Issues from Life Cycle Perspective 2.1 Mobile Computing and Apps Security Challenge 2.2 3rd Party App Derived Security Issues 3. Mobile Apps Development Management 4. Mobile Apps Coding and Audit Management Security Issues 4.1 Intentional Misconduct 4.2 Negligence 4.3 Native Problem Mobile Application Security Testing Initiative White Paper TABLE OF CONTENTS 2016/03 4

5. What is the next Promote “ CSA STAR Mobile App Security Certification” 1.Set the “STAR Mobile App Security Certification Project” 2.Define “STAR Mobile App Security Certification” Framework 3.Create CSA CCM Addendum for Mobile App Security Certification set 4.Design the Training courses 5.Pilot sites 2016/03 5

6. STAR Mobile App Security Certification Project Head, Solution Architecture, Strategic Technology Partners, Amazon Web Services Professional –cloud computing, governance, information security and technology management CISA, CISM, CGEIT, CIP CEO, Gapertise, Taiwan Advisor, Mobility Security Council, Govn't of Taiwan Research domain –UWCE/UWSE, MRM, VM, –Open source (Linux), ERP, e Business 2016/03 6 Co-Chair Eric Wang Co-Chair Douglas Lee

7. We are the initiator you are the creator join STAR Mobile App Security Certification Project csa-apac-research@cloudsecurityalliance.org