Comments
yourfanat wrote: I am using another tool for Oracle developers - dbForge Studio for Oracle. This IDE has lots of usefull features, among them: oracle designer, code competion and formatter, query builder, debugger, profiler, erxport/import, reports and many others. The latest version supports Oracle 12C. More information here.
Cloud Expo on Google News
SYS-CON.TV
Cloud Expo & Virtualization 2009 East
PLATINUM SPONSORS:
IBM
Smarter Business Solutions Through Dynamic Infrastructure
IBM
Smarter Insights: How the CIO Becomes a Hero Again
Microsoft
Windows Azure
GOLD SPONSORS:
Appsense
Why VDI?
CA
Maximizing the Business Value of Virtualization in Enterprise and Cloud Computing Environments
ExactTarget
Messaging in the Cloud - Email, SMS and Voice
Freedom OSS
Stairway to the Cloud
Sun
Sun's Incubation Platform: Helping Startups Serve the Enterprise
POWER PANELS:
Cloud Computing & Enterprise IT: Cost & Operational Benefits
How and Why is a Flexible IT Infrastructure the Key To the Future?
Click For 2008 West
Event Webcasts
Android Security Essentials LiveLessons (Video Training) Review

I unintentionally watched all three hours of this video series in one sitting. The presenter hooked me and before I knew it, it was three hours later. It is a very fast paced tour of the security issues that can arise when using the Android platform. The tour is built around the Open Web Application Security Project (OWASP) top 10 Mobile Security Risks as a guideline.

The Open Web Application Security Project (OWASP) top 10 Mobile Security Risks are -

M1: Weak Server Side Controls
M2: Insecure Data Storage
M3: Insufficient Transport Layer Protection
M4: Unintended Data Leakage
M5: Poor Authorization and Authentication
M6: Broken Cryptography
M7: Client Side Injection
M8: Security Decisions Via Untrusted Inputs
M9: Improper Session Handling
M10: Lack of Binary Protections

It seems like every security consulting firm engagement I hear about lately finds one or two things that in some other context/environment would make them dangerous, tells you to fix them, and recommends you review the OWASP top ten lists. They get their check and say see you in 6 months.

I have seen companies blindly follow the directions given by a compliance/security audit that were a total waste of a lot of money on completely unwarranted requests. Everyone involved with approving and allowing them to be done should have been assessed for competency.

This type of thing happens a lot as technologies change. Web and mobile applications are not the same thing. To think you can simply hop from one to the other is nuts, and no, using HTML5 everywhere does not change that. This happens in more areas than just security, but with regards to security, although the high level types of attacks seem similar, the details of how they are carried out and what you need to do to protect your systems are not.

Luckily this video series drills in on the details of Android attacks. You won't walk away from this series a security expert, but you will walk away with an appreciation for how far hackers will go to get your data. You will also have a solid baseline understanding of the entire spectrum of the Open Web Application Security Project (OWASP) top 10 Mobile Security Risks, how they can be used to secure your android applications, and how hackers are going to attack your applications.

The presenter is engaging and easy to follow, there are a ton of demos, and all the material is very interesting. I would recommend this video series to anyone involved with an Android development project, but if you are a developer and you want to understand the details of what the presenter is talking about, you should have Android development experience. I say anyone can watch it, because even if you don't understand all the technical mumbo jumbo, you will understand how serious security should be taken, and what the end result will be if you don't.

Below is the description from the products web page. I simply pasted it below because I felt it was very accurate and it explains each lesson clearly.

You can check out previews and buy the series here.

Android applications make use of advanced hardware and software, as well as local and server data, exposed through the platform to bring innovation and value to consumers. To protect that value, the platform must offer an application environment that ensures the security of users, data, applications, the device, and the network. Securing an open platform requires a robust security architecture and rigorous security programs, as well as developers who are aware of the security issues that may come up.

Android Security Essentials LiveLessons alerts developers to the security issues that can arise when using the Android platform and guides them though solutions. Godfrey Nolan covers best practices for Android security by examining common security scenarios. Each lesson begins by presenting the concept behind the security problem at hand, with snippets of code introduced as the problem is explored. This is then followed by examination of code or demonstration of tools showing you how to implement the concepts presented.

Lesson 1: Android Security Basics
This lesson explains the problems with Android from a security perspective. We dive right in and show how to reverse engineer an Android APK to view its source as well as backup an APK’s data to see what runtime customer information is exposed. The lesson also introduces the OWASP Mobile top 10 risks from the Open Web Application Security Project which we cover detail in each lesson.

Lesson 2: Dealing with Insecure Data
Lesson 2 walks you through where runtime data is stored on the Android device, how to use Android file permissions to securely write data to an SD-card and also looks at how to write securely to a SQLite database.

Lesson 3: Weak Server Side Controls
This lesson deals with storing and securing data stored on backend web servers or in the cloud. You learn what the implications are of using remote servers for storing application data as well as how to secure the data.

Lesson 4: Insufficient Transport Layer Protection
This lesson builds on what we learned in Lesson 3. You learn how to perform a man-in-the-middle attack to see how insecure data is transmitted and how SSL can secure the traffic.

Lesson 5: Client Side Injection
Many Android apps are not 100% native and contain one or more HTML pages as webviews. Learn how to secure these hybrid apps by understanding how cross-site scripting and SQL injection are used to attack your web server.

Lesson 6: Poor Authorization
This lesson explains what the options are for logging in to an Android app, how they can be compromised and best practices for user authorization.

Lesson 7: Improper Session Handling
Building on Lesson 6, this lesson explains why mobile sessions are different from web sessions. Learn how to implement mobile sessions securely as well as use OAuth to log in to social media websites.

Lesson 8: Security Decisions via Untrusted Inputs
Learn how the Android framework manages communication between Android apps and how that can be exploited. Understand the principle of minimum Android manifest permissions and what permissions should be avoided.

Lesson 9: Side Channel Data Leakage
Android apps, probably more than other mobile platform, have a tendency to leak information in log files. In the past, third party libraries from advertising companies have also collected more customer information than they needed. In this lesson learn how to remove all logging for your production app and how to use proxy servers and decompilers to know exactly what your third party apps are collecting.

Lesson 10: Broken Cryptography
Learn what types of synchronous and asynchronous encryption can be used in Android apps, why it’s not a good idea to store the keys in the code or on the device, how to store the key using the NDK as well as encryption best practices using asynchronous techniques.

Lesson 11: Sensitive Information Disclosure
While Lesson 2 looked at the runtime information that may or may not be exposed, Lesson 11 looks at how developers are exposing information hard coded in the compiled application such as encryption keys and how this potentially exposes more customer information.

Lesson 12: Conclusion
In the final lesson we review the OWASP top 10 and use a tool from OWASP called GoatDroid that will help you get a better understanding of how to write more secure Android code.

You can check out previews and buy the series here.

Read the original blog entry...

About Tad Anderson
Tad Anderson has been doing Software Architecture for 18 years and Enterprise Architecture for the past few.

Latest Cloud Developer Stories
DX World EXPO, LLC, a Lighthouse Point, Florida-based startup trade show producer and the creator of "DXWorldEXPO® - Digital Transformation Conference & Expo" has announced its executive management team. The team is headed by Levent Selamoglu, who has been named CEO. "Now is the ...
"Space Monkey by Vivent Smart Home is a product that is a distributed cloud-based edge storage network. Vivent Smart Home, our parent company, is a smart home provider that places a lot of hard drives across homes in North America," explained JT Olds, Director of Engineering, an...
SYS-CON Events announced today that Conference Guru has been named “Media Sponsor” of the 22nd International Cloud Expo, which will take place on June 5-7, 2018, at the Javits Center in New York, NY. A valuable conference experience generates new contacts, sales leads, potentia...
DevOps is under attack because developers don’t want to mess with infrastructure. They will happily own their code into production, but want to use platforms instead of raw automation. That’s changing the landscape that we understand as DevOps with both architecture concepts (Clo...
In his Opening Keynote at 21st Cloud Expo, John Considine, General Manager of IBM Cloud Infrastructure, led attendees through the exciting evolution of the cloud. He looked at this major disruption from the perspective of technology, business models, and what this means for enter...
Subscribe to the World's Most Powerful Newsletters
Subscribe to Our Rss Feeds & Get Your SYS-CON News Live!
Click to Add our RSS Feeds to the Service of Your Choice:
Google Reader or Homepage Add to My Yahoo! Subscribe with Bloglines Subscribe in NewsGator Online
myFeedster Add to My AOL Subscribe in Rojo Add 'Hugg' to Newsburst from CNET News.com Kinja Digest View Additional SYS-CON Feeds
Publish Your Article! Please send it to editorial(at)sys-con.com!

Advertise on this site! Contact advertising(at)sys-con.com! 201 802-3021



SYS-CON Featured Whitepapers
ADS BY GOOGLE