From the blog

From Windows Certificate Store to TMS Cryptography Pack TX509Certificate component.

TX509Certificate is a component of TMS Cryptography Pack to use X509 certificates. With it, we can sign certificate signing request (CSR) or use it in XAdES, CAdES or PAdES to sign or verify documents. We can generate self-signed certificates, import them from PEM file, from PEM string, from PFX file. In this post, I will explain how to import certificate from Windows Certificate Store. To do that, we have to use the crypt32 DLL and CertOpenSystemStore and CertFindCertificateInStore. CertOpenSystemStore function CertOpenSystemStore(hProv: HCRYPTPROV; szSubsystemProtocol: LPCTSTR) : hCertStore; This function is used to open the certificate store. The microsoft documentation is here. The first parameter hProv is not used and should be set to NULL. The second parameter is a string that names a system store. Most common options are: You can use CertEnumSystemStore function to list the names of existing system stores. The function returns an handle to the store. CertFindCertificateInStore function CertFindCertificateInStore(hCertStore: hCertStore; dwCertEncodingType, dwFindFlags, dwFindType: DWORD; pvFindPara: Pointer; pPrevCertContext: PCCERT_CONTEXT): PCCERT_CONTEXT; The function finds a certificate in a given store. The Microsoft documentation is here. The first parameter is the handle of the store, returned by CertOpenSystemStore. The second parameter is the encoding type of the cert. The options are: X509_ASN_ENCODING PKCS_7_ASN_ENCODING We will use only X509_ASN_ENCODING because it is the certificate encoding type. The third parameter is used with some dwFindType values to modify the search criteria. For most dwFindType values, dwFindFlags is not used and should be set to zero. The fourth parameter specifies the type of search being made. For the complete list of options, you can read the documentation. We will use in this example the CERT_FIND_SUBJECT_NAME option, to search from subject name of the certificate. The fifth parameter contains the content of the search. In your example, it will contain the subject name of the certificate we want. The sixth parameter is a pointer to the last CERT_CONTEXT structure returned by this function. This parameter must be NULL on the first call of the function. To find successive certificates meeting the search criteria, set pPrevCertContext to the pointer returned by the previous call to the function. If the function succeeds, the function returns a pointer to a read-only CERT_CONTEXT structure. A CERT_CONTEXT structure is: _CERT_CONTEXT = record dwCertEncodingType: DWORD; pbCertEncoded: LPBYTE; cbCertEncoded: DWORD; pCertInfo: PCERT_INFO; hCertStore: hCertStore; end; dwCertEncodingType is the encoding type of the certificate, pbCertEncoded is the content of the certificate, cbCertEncoded is the length of the certificate, pCertInfo is the certificate information and hCertStore is the store. Code The code to import a TX509Certificate from the Windows Certificate Store is the following: unit Unit1; interface uses Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics, Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls, CryptBase, X509Obj, MiscObj; const X509_ASN_ENCODING = $00000001; CERT_FIND_SUBJECT_STR = 8 shl 16 or 7; // values taken from System.Net.HttpClient.Win type HCRYPTPROV = ULONG_PTR; _CERT_CONTEXT = record dwCertEncodingType: DWORD; pbCertEncoded: LPBYTE; cbCertEncoded: DWORD; pCertInfo: PCERT_INFO; hCertStore: hCertStore; end; PCERT_CONTEXT = ^_CERT_CONTEXT; PCCERT_CONTECT = PCERT_CONTEXT; function ExtractCertWindowsStore(subjectName: string): TX509Certificate; function CertOpenSystemStore(hProv: HCRYPTPROV; szSubsystemProtocol: LPCTSTR) : hCertStore; stdcall; external ‘crypt32.dll’ name ‘CertOpenSystemStoreW’; function CertFindCertificateInStore(hCertStore: hCertStore; dwCertEncodingType, dwFindFlags, dwFindType: DWORD; pvFindPara: Pointer; pPrevCertContext: PCCERT_CONTEXT): PCCERT_CONTEXT; stdcall; external ‘crypt32.dll’ name ‘CertFindCertificateInStore’; implementation {$R *.dfm} function ExtractCertWindowsStore(subjectName: string): TX509Certificate; var Store: hCertStore; Cert: PCCERT_CONTEXT; s: string; i: integer; Conv: TConvert; X509Cert: TX509Certificate; begin Cert := nil; Store := CertOpenSystemStore(0, PChar(‘MY’)); if […]

Read More

Celebrating 20 days the 20 year company anniversary!

It’s a special year for our team as we celebrate the company’s 20th birthday this month. We’ve come a long way over the years, so we wanted to celebrate this together with YOU! Officially on October 17, 2000 the company tmssoftware.com bvba was registered in Belgium. tmssoftware.com bvba ws founded by Bruno Fierens to prepare his operations for the next steps and next level. Since the very beginning of Delphi in 1995, Bruno Fierens was operating as self-employed consultant developing and offering VCL components on the market. On October 17, we plan to look back a bit more in detail on the history of the company but from today we start the 20 days action to celebrate our 20 year anniversary! 20% longer updates and support with licenses in the next 20 days Yes, you hear that correct. For every license purchased (new license, upgrade, renewal) you receive 20% EXTRA time of free updates and free support coming with the product. So, products that come with free 1 year of updates and support, you now receive 20% more, or 438 days instead of 365 days (1 year). This action runs for 20 days, from October 8 to October 28. It is offered to anyone, also loyal existing customers can purchase a renewal and will get an extra 20% renewal time. Also if you have licenses that are not yet expired, you can now already purchase a renewal and these 438 days will be added to your remaining free update & support period. Your opportunity to get one of a limited edition run of 20 pieces of the book “Delphi Hands-on with TMS FNC Maps” For our 20th anniversary we are producing a hyper limited run of 20 pieces only of a full color version of the “Delphi Hands-on with TMS FNC Maps” book. This book will have a special preface with a retrospective of the company written by Bruno Fierens and will be hand signed by the Belgian team. To get a chance to win one of these limited edition books, share an anecdote about the TMS team, the TMS products, TMS events or share a screenshot of your product, your favorite blog article… in the comments section under this blog or on our social media and win the brand new and limited edition TMS FNC Maps hands-on book in color! Twitter: Tag @TMSsoftwareNews & use following hashtags: #tmssoftware , #delphi and #embarcadero Facebook: Tag @tmssoftware & use following hashtags: #tmssoftware , #delphi and #embarcadero YouTube: Tag @tmssoftwareTV & use following hashtags: #tmssoftware , #delphi and #embarcadero Our team will choose from the most extraordinary or special anecdotes/comments found on this blog comment section or on our social media channels and give send the limited edition of the book to your home. Celebrate TMS components with us this October. We are proud of our big TMS family all around the world. Thank you for the many years of trust. Looking forward to the next 20 years!

Read More

Celebrating our 20th anniversary!

As you may already know, this October we are celebrating our company’s 20th birthday! And of course we want you to celebrate with us. In addition to the current ongoing action of winning a limited edition “TMS FNC Maps hands-on” book, we have another special promotion for you! Get 30% discount on online courses at landgraf.dev This promotion runs until November 15, 2020. Available courses TMS Business Masterclass: Delphi developers looking to learn more about ORM, REST/JSON development, multi-tier applications and also some background about TMS Business tools, with code examples.Introduction to TMS WEB Core: Developers looking to build WEB applications using Delphi, following modern Single-Page-Application architecture. What is the language spoken in the course? In all videos of this training course you have the options to turn on subtitles, and they were not auto-translated. All subtitles were written manually to make sense and with technical terms spelled correctly. Full source code for examples Each lecture of this course that uses a sample project has an associated downloadable file which includes the full source code of the example. Your Instructor Wagner is founder of landgraf.dev, a place for Delphi developers to find information and courses about Delphi. Even though being a Master of Science in Engineering, he’s a developer at heart. Having worked with Delphi since its very first version in 1995, and being partner of TMS Software (a renowned company that provides solutions for Delphi), Wagner is the main developer behind popular Delphi frameworks like TMS Aurelius, TMS XData and TMS Scripter, among others. Take advantage of this special discount and be one of the first to secure your place in these online course with Wagner Landgraf at landgraf.dev.

Read More

Today Oct 17, tmssoftware.com BV celebrates its 20 year anniversary

Company foundation On October 17 in the year 2000, the company “tmssoftware.com bvba” was officially founded in Belgium. So, this year 2020, we celebrate on October 17 the 20-year anniversary of the company. After I started developing VCL components in 1995 with the release of Borland Delphi 1, I did this for the first 5 years as first part-time self-employed consultant and later full-time self-employed under the umbrella of “TMS software”. By the year 2000, it became clear that the next step in this process of growth was to found a company, have a separate office, and prepare to hire the first employee. Official declaration of the creation of the company in the Belgian register First steps As Delphi was born and brought Pascal developers RAD component-based development, I quickly realized there was a huge potential in creating components myself to enable me to reuse interesting code among various consulting projects I was doing for companies. I realized that when these components would be of interest to myself, these could probably also have value for other Delphi developers. Fortunately, at that time, there were two websites (Delphi Super Pages and Torry.net) that allowed Delphi developers to share created components with other developers. I was curious to try this out and the very first component released on Torry and Delphi Super Pages was TANIIcon. This was a functionality I had not seen before from other Delphi developers and the component showed on screen animated cursors. I decided to create this component especially because I had not seen it done before and also because it introduced the challenge to create a component with custom property streaming as well as the creation of a custom property editor to pick and preview the animated cursor at design-time. It was a great experience to learn about the internals of the VCL framework. Meanwhile, for my own internal use in consulting projects, I had been working on a component descending from TStringGrid to add loads and loads of features I was needing over and over again in projects. This became TAdvStringGrid and was the first big component I released in a Shareware version. It was released on Delphi Super Pages and Torry and by 1996, I realized we needed a website. In Belgium, these were the early days of the Internet and it was through the ISP that we could get a limited free space for basic HTML pages. It could be found at http://users.skynet.be/tmssoftware. But of course, it no longer exists now. It was only from 1998 that the domain tmssoftware.com was purchased and all pages were moved to a shared hosted server for this domain. Between 1996 and 1998, it was still non-trivial to handle online payment transactions. It was common for developers to send a payment by cheque to purchase shareware. Fortunately, in 1998, Element5 AG in Germany offered its ShareIt service providing a platform for software developers to handle online payments and I almost immediately jumped on it. Fast-forward to the year 2000, the amount of work involved with developing, marketing, selling, supporting VCL components had grown into a more than full-time job. So, it was time to structure this into the company “tmssoftware.com bvba” and move to newer and bigger office spaces. And it is this 20-year anniversary we celebrate today. […]

Read More

Microsoft Edge WebView2 general availability!

Intro Microsoft has recently announced general availability of the WebView2 embedded browser control, part of Microsoft Edge Chromium. https://blogs.windows.com/msedgedev/2020/10/19/edge-webview2-general-availability/. In this blog post, I want to summarize the steps you can take, to configure your or your customer’s environment, and making sure browser components that target the Microsoft Edge Chromium embedded WebView2 interfaces are properly initialized. Microsoft Edge Chromium support is included in TMS FNC Core (TTMSFNCWebBrowser) & TMS VCL UI Pack (TAdvWebBrowser). Using one of those components requires you to follow 2 steps to get the browser up & running on your system. 1) Make sure Microsoft Edge Chromium is available on your system When using one of the above components you need to make sure that Microsoft Edge Chromium is available on your system. There are 3 ways to make either TAdvWebBrowser or TTMSFNCWebBrowser pick up edge. 2) Copy the necessary DLLs to communicate with WebView2 embedded browser control The second step is copying both WebView2Loader_x86.dll & WebView2Loader_x64.dll in to the system32 & sysWow64 folders. Both DLLs can be found in the installation folder, in a sub folder “Edge Support”. After copying both DLLs, to target 32 & 64 bit Windows applications, start the IDE (RAD Studio, or Lazarus), and drop an instance of TAdvWebBrowser or TTMSFNCWebBrowser. The message you will see that indicates the browser is properly initialized is displayed in the screenshot below. Depending on the chosen technique to install Microsoft Edge Chromium, or making sure Microsoft Edge Chromium is available on your system can slightly differ. Deploying your application to your customer When developing your application that uses a TAdvWebBrowser or TTMSFNCWebBrowser, you want to make sure it runs on the customer’s machine. When the customer has Windows updates turned on, Microsoft Edge Chromium should be available on his system. The implementation of TAdvWebBrowser or TTMSFNCWebBrowser checks if this is true, and automatically makes a copy to work with. So no additional steps are required there. Note that this process might take some time when the browser is dropped on the form for the first time, or your application is running for the first time. Each time an update is pushed from Windows updates, a new copy is made to a temporary folder. If you do not want this and you want your application initialization faster you can separately download and install the WebView2 Evergreen runtime (https://developer.microsoft.com/en-us/microsoft-edge/webview2/) on the customer’s machine. This will ensure a proper installation of Microsoft Edge Chromium ready to be used for an embedded browser control. Installing DEV, BETA or CANARY is not recommended when deploying your application. These insider builds are only for development purposes. More info about the application distribution is explained here: https://docs.microsoft.com/en-us/microsoft-edge/webview2/concepts/distribution

Read More

TMS FNC Maps Team Effort (v1.2)

Team Effort Since the first release we have been working hard and only 4 months after the release, we pushed out an update (v1.1) for TMS FNC Maps with loads of exciting stuff. Now, we are here with another update (v1.2), that brings even more exciting features and a new service. Introducing Apple MapKit JS service TTMSFNCOpenLayers with the ability to configure a custom tile server TTMSFNCMapBox & TTMSFNCTomTom with a property to control the map style Anchoring & Z-Index support in TTMSFNCGoogleMaps TTMSFNCElevation: A new non-visual component to retrieve elevation data based on coordinate Greatly Improved performance loading & parsing GPX files Faster loading of markers & poly elements Getting elevation data from GPX files Bringing all of the above together in a significant update requires a lot of hard work and team effort. TMS FNC Maps v1.2 is a result of a collaboration between various people within the TMS family: Bart Holvoet: Extensive API knowledge and master in REST services, implementation Gjalt Vanhouwaert: Intensive feedback & testing, creating cross-platform demos Holger Flick: Providing feedback & testing, creator of the TMS FNC Maps book Pieter Scheldeman: Architecture & design choices, research on APIs & services, implementation Masiha Zemarai: Marketing campaign, social media & support REST API & mapping services Bringing together multiple mapping services and REST APIs with radically different architecture in one unified cross-platform, cross-framework product was quite a challenge. Thanks to our TMS team effort we succeeded in making this a seamless experience for our customers who can switch services by changing a single property value. – Bart Creating cross-platform demos I joined the TMS FNC Maps task force to create some demos for the customers. My first thought was that it would take days before I could get started with anything useful. But the implementation feels so natural that you can already have a simple application with only 2 lines of code. All of the handling that you want, is implemented in such a way that even for some really cumbersome things, you just need one line of code. You can find a simple example in one of my videos. You can find an online demo here. In just one day I created three different demos for four different platforms. This is the perfect example of the simplicity of working with TMS FNC Maps. And the power of FNC components in general. – Gjalt Edge Chromium TTMSFNCWebBrowser has been updated to offer the support for the latest Edge Chromium stable version. This update will automatically be available when installing TMS FNC Core. More details on how to install Edge Chromium can be found here. TMS FNC Maps Book TMS FNC Maps offers a set of demos and documentation to get you started, but if you really want to energize your developments the TMS FNC Maps Book is a must have!

Read More

Release Announcement – September 23, 2020

Published September 23, 2020 WRITTEN BY THE KIUWAN TEAMExperienced developers, cyber-security experts, ALM consultants, DevOps gurus and some other dangerous species. The Kiuwan team is excited to announce the availability of our latest release, featuring extended support for JSX React, the ability to check for dynamic components built using an Angular framework; and an updated plugin for Jenkins. Angular dynamic components  We’ve expanded our JavaScript support with this release. Now, Kiuwan is able to check for dynamic components built in an Angular framework. The underlying vulnerability from using dynamic component construction is identical to other types of “eval injection” issues, as described in the description of CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (‘Eval Injection’). Dynamic component construction makes it possible for an attacker to attacker to “execute arbitrary code, or at least modify what code can be executed,” potentially giving the attacker full control of the browser environment. JSX React Previously, Kiuwan’s JavaScript implementation provided partial support for React. Now, this support is extended with JSX technology. JSX, or JavaScript XML, is an XML-like syntax extension to ECMAScript part of the React library. The complete specification is available at Draft: JSX Specification. The following elements have been identified as potential security flaws and are detected by the existing JS rules: The dangerouslySetInnerHTML attribute acts as the entrance door to perform an XSS attack (See dangerouslySetInnerHTML). Server-side rendering attacker-controlled initial state XSS in React apps using Redux. XSS in explicit calls to React.createElement(…) with untrusted props or children (See Avoiding XSS in React is Still Hard). Attribute injection also leads to XSS. In React, the HTML code is embedded into the JS code, so the HTML code must be checked to mark sources, sinks, or neutralization (For example: elements). Also, the embedded HTML code is analyzed by Kiuwan with the rules from the HTML technology. The following existing checks may be applied: OPT.HTML.AutocompleteOnForSensitiveFields. OPT.HTML.MissingPasswordFieldMasking. OPT.HTML.TargetBlankVulnerability. OPT.HTML.SandboxAllowScriptsAndSameOrigin. OPT.HTML.SpecifyIntegrityAttribute. Kiuwan plugin for Jenkins update The Kiuwan Plugin for Jenkins allows you to execute a Kiuwan analysis as a Post-build action or as a Pipeline step.  For full documentation or to download the plugin, refer to the links below: In this release, we’ve updated the Kiuwan plugin for Jenkins as described below: Connection Profiles: Previously, Kiuwan Jenkins Plugin’s connection settings were limited to one configuration per Jenkins installation. Now, you can set several profiles, you can use multiple accounts, and Kiuwan On-Premises customers may use different environments.  New analysis result dashboard. Improved support for short-lived nodes. Pipeline support. Additional bug fixes and improvements For a full list of additional bug fixes and improvements, refer to our Change Log.

Read More

Threat Modeling’s Place in DevSecOps

Published September 30, 2020 WRITTEN BY MICHAEL SOLOMON Michael G. Solomon, PhD, CISSP, PMP, CISM, PenTest+, is a security, privacy, blockchain, and data science author, consultant, educator and speaker who specializes in leading organizations toward achieving and maintaining compliant and secure IT environments. Developers often pursue well-intentioned security efforts by focusing on writing secure code. But that’s just part of the puzzle. Instead of focusing only on the code, it’s just as critical to focus on the attacker. Understanding how attackers compromise controls changes the way developers think about security. A revealing question is: “How could an attacker use my code for malicious purposes?” Thinking in this way changes the whole development perspective. The general process of assessing vulnerabilities in software from an attacker’s point of view is commonly referred to as threat modeling. The main purpose of threat modeling is to assess an application and its surrounding environment to find as many vulnerabilities as possible before attackers do. Threat modeling isn’t new; mature development organizations have been threat modeling for a couple of decades. One of the earlier approaches to formal threat identification was the idea of “threat trees,” introduced by Edward Amoroso in 1994. A similar early view came from Bruce Schneier in the form of “attack trees.” Both approaches use conceptual diagrams to illustrate how a target might be attacked. Microsoft was an enthusiastic early adopter of formal application development threat modeling and introduced the STRIDE approach. A few years later an operations-centric approach, OCTAVE, was introduced. Today, threat modeling is finding renewed interest as organizations move toward DevSecOps approaches. Some may consider threat modeling an artifact from the ’90s, but the philosophy fits well into current development approaches. Introducing threat modeling to a DevOps team Traditionally, threat modeling is an application design activity. However, solutions are emerging that use testing and post-deployment behavior to feed threat modeling analysis. In short, threat modeling has moved from application design to include operations. That means DevSecOps can benefit at all phases from comprehensive threat modeling. Expand your thought boundaries Remember, DevSecOps is a culture, not an organization. It’s all about removing isolation and barriers that tend to compartmentalize activities and valuable information and reduce both efficiency and quality. Prior to DevOps or DevSecOps, most organizations created silos of process and information and protected the integrity of those islands. That’s not to say that silos were created exclusively with selfish intent; silos tend to be self-preserving and naturally occurring. But in reality, breaking down silos leads to better communication, higher product quality, and more longevity. Sharing tribal knowledge and using it to “sand down the rough edges” of a product or service makes the entire development process better and customers happier. This requires change, and while change may be good, it often isn’t fun. Resistance to change tends to be one of the most difficult barriers to clear in any project. You must convince the stakeholders that the proposed change is worth the effort. In short, you have to change the culture of the comfortable norms.  Change for the sake of change doesn’t get you very much. But change to pursue growth can be satisfying and rewarding. It is the latter type of change that makes threat modeling a good fit for a DevSecOps organization. The two philosophies work well together.  […]

Read More

October is Cybersecurity Awareness Month

Published October 6, 2020 WRITTEN BY THE KIUWAN TEAMExperienced developers, cyber-security experts, ALM consultants, DevOps gurus and some other dangerous species. October is Cybersecurity Awareness Month. The theme for 2020 is: “Do Your Part. Be #CyberSmart.”  This event, put on by CISA and the National Cyber Security Alliance, is in its seventeenth year. The campaign aims to increase overall cybersecurity awareness, helping both private individuals and companies develop a safer, more secure environment for both themselves and their customers. This year’s “Do Your Part” theme encourages each individual to take a proactive approach to improve overall security.  Why have a “Cybersecurity Awareness Month”? The internet and an online identity have become increasingly important parts of the world. Most people are now connected in some form. Businesses rely on that connectivity to do business. A lack of cybersecurity, however, can open up both businesses and personal individuals to potential attacks.  Unfortunately, much of the world failed to recognize those potential threats even as they embraced the opportunities offered by the internet and connectivity. In 2004, CISA and the National Cyber Security Alliance decided that it was time to start spreading awareness. Out of that, National Cybersecurity Awareness Month was born. The program aims to increase public knowledge about the potential threats both businesses and private individuals can suffer based on the information they place online. Many people simply do not recognize the errors they commit every day, from insecure passwords to failing to take the right measures to protect their devices. Organizations fall victim to phishing scams every day because employees fail to recognize them for what they are. By increasing awareness, both within organizations and across social media and other popular platforms, National Cybersecurity Awareness Month helps keep businesses and individuals safer online. What’s behind the theme: “Do Your Part: Be #CyberSmart”? Many cybersecurity professionals acknowledge that the greatest threat to most organizations isn’t a threat from the outside. It’s the employees. Phishing attacks, for example, remain at the top of the list of potential challenges that many organizations face each year. Unfortunately, in order for phishing attacks to be successful, an employee must make an error: giving out confidential information, clicking an insecure link, or otherwise giving a scammer a window into the organization. By encouraging each person to do their part, this year’s Cybersecurity Awareness Month theme encourages personal accountability for each member of the team. Securing a company requires commitment from all of its employees. Proper education and awareness, however, can go a long way toward improving organization security.  What events are planned for Cybersecurity Awareness Month? Cybersecurity Awareness Month is dedicated to improving cybersecurity awareness and organization across the United States. It’s a national event, celebrated by tech companies and companies interested in improving technical awareness alike. Each week, Cybersecurity Awareness Month focuses on a different topic: Week of October 5 (Week 1): If You Connect It, Protect It: A look at what devices really need to be protected and how the Internet of Things can have a powerful impact on your office environment.  Week of October 12 (Week 2): Securing Devices at Home and Work: With more employees than ever working remotely, it’s important to consider what you can do to protect devices on your home network–as well as providing additional security when those devices […]

Read More

8 Tips for Mobile App Security

WRITTEN BY THE KIUWAN TEAMExperienced developers, cyber-security experts, ALM consultants, DevOps gurus and some other dangerous species. According to a report from IBM just a few years ago, as many as 50% of companies had no budget for mobile app security. This is especially worrying because, in the first half of 2019 alone, there were data breaches that exposed around 4.1 billion records. A more recent study also showed that 3 out of 4 apps leaked sensitive data that exposed users to fraud and identity theft. Incidences of app data breaches are increasing at an alarming rate, undermining consumer trust in mobile app safety. App users trust you enough to share their sensitive data on your platform, and the responsibility of ensuring the app is secure falls on leaders of mobile app development teams. This begs the question, how do you ensure that the users of your app are protected against data breaches? Here are 8 approaches to securing your mobile application. 1.  Add an extra layer of security to the login process The Verizon 2019 Data Breach Investigations Report showed that approximately 80% of all data breaches occur due to weak credentials. This is why you need to put identification, authentication, and authorization measures in place. Use authorization technology or adopt the 2FA (two-factor authentication) method to add an extra layer of security to the login process. Biometrics such as fingerprints and retina scans are some recent authentication methods, which are more reliable than the 2FA. You should also encourage your app users to set strong passwords and update them regularly or ask the developers to design the app to only accept strong alphanumeric passwords. 2.  Conduct vulnerability testing If hackers were to attack your app today, how well would it hold up? No one ever thinks that their app could be a hacker’s target — until it is. As part of a mobile development team, you are bound to be biased and are wired to assume that your app is extremely secure. However, you should never leave mobile app security to chance, which is why you should conduct vulnerability testing periodically. Identify all security loopholes in your app’s infrastructure and fix them before it’s too late. You will require an effective application vulnerability scanning with a tool like Kiuwan, which supports Swift, Java, Kotlin, and Objective-C. 3.  Secure your app’s code from the ground up Your app’s security doesn’t begin after deployment of the application; it should be part of the development process. Make security a priority and protect your code from vulnerabilities that are often caused by developer error or lack of testing. To protect your mobile app’s code, keep it encrypted through minification and obfuscation coupled with API encryption. Run source code scanning and ensure that your security measures don’t affect the user experience and the app’s performance. 4.  Implement a good data encryption policy Ensure that all data being exchanged on your app is encrypted. This way, even if hackers get past your security, they won’t access any sensitive information. Avoid storing sensitive data on mobile devices or on your servers, and if it’s necessary, keep the data storage to an absolute minimum and in an encrypted format. For instance, the iOS keychain contains encrypted data storage.   If you keep logs, make sure they are […]

Read More