More Like this

1. Data Protection Labware for Mobile Security

   https://doi.org/10.1007/978-3-030-24907-6_15  

   Hossain Shahriar, Md Arabin (July 2019, Proc. of 12th International Conference on Security, Privacy, and Anonymity in Computation, Communication, and Storage (SpaCCS))

   The majority of malicious mobile attacks take advantage of vulnerabilities in mobile applications, such as sensitive data leakage via inadvertent or side channel, unsecured sensitive data storage, data transmission, and many others. Most of these mobile vulnerabilities can be detected in the mobile software testing phase. However, most development teams often have virtually no time to address them due to critical project deadlines. To combat this, the more defect removal filters there are in the software development life cycle, the fewer defects that can lead to vulnerabilities will remain in the software product when it is released. In this paper, we provide details of a data protection module and how it can be enforced in mobile applications. We also share our initial experience and feedback on the module. 

   more » « less
2. Authentic Learning Secure Software Development (SSD) in Computing Education

   https://doi.org/10.1109/FIE.2018.8659217  

   Qian, Kai; Lo, Dan; Parizi, Reza; Wu, Fan; Agu, Emmanuel; Chu, Bei-Tseng (October 2018, IEEE Frontiers in Education (FIE) Conference)

   As mobile computing is now becoming more and more popular, the security threats to mobile applications are also growing explosively. Mobile app flaws and security defects could open doors for hackers to break into them and access sensitive information. Most vulnerabilities should be addressed in the early stage of mobile software development. However, many software development professionals lack awareness of the importance of security vulnerability and the necessary security knowledge and skills at the development stage. The combination of the prevalence of mobile devices and the rapid growth of mobile threats has resulted in a shortage of secure software development professionals. Many schools offer mobile app development courses in computing curriculum; however, secure software development is not yet well represented in most schools' computing curriculum. This paper addresses the needs of authentic and active pedagogical learning materials for SSD and challenges of building Secure Software Development (SSD) capacity through effective, engaging, and investigative approaches. In this paper, we present an innovative authentic and active SSD learning approach through a collection of transferrable learning modules with hands-on companion labs based on the Open Web Application Security Project (OWASP) recommendations. The preliminary feedback from students is positive. Students have gained hands-on real world SSD learning experiences with Android mobile platform and also greatly promoted self-efficacy and confidence in their mobile SSD learning. 

   more » « less
3. Authentic Learning Secure Software Development (SSD) in Computing Education

   Qian, Kai; Lo, Dan; Parizi, Reza; Wu, Fan; Agu, Emmanuel; and Chu, Bei-Tseng (December 2018, 2018 IEEE Frontiers in Education Conference (FIE))

   As mobile computing is now becoming more and more popular, the security threats to mobile applications are also growing explosively. Mobile app flaws and security defects could open doors for hackers to break into them and access sensitive information. Most vulnerabilities should be addressed in the early stage of mobile software development. However, many software development professionals lack awareness of the importance of security vulnerability and the necessary security knowledge and skills at the development stage. The combination of the prevalence of mobile devices and the rapid growth of mobile threats has resulted in a shortage of secure software development professionals. Many schools offer mobile app development courses in computing curriculum; however, secure software development is not yet well represented in most schools' computing curriculum. This paper addresses the needs of authentic and active pedagogical learning materials for SSD and challenges of building Secure Software Development (SSD) capacity through effective, engaging, and investigative approaches. In this paper, we present an innovative authentic and active SSD learning approach through a collection of transferrable learning modules with hands-on companion labs based on the Open Web Application Security Project (OWASP) recommendations. The preliminary feedback from students is positive. Students have gained hands-on real world SSD learning experiences with Android mobile platform and also greatly promoted self-efficacy and confidence in their mobile SSD learning. 

   more » « less
4. OWASP Risk Analysis Driven Security Requirements Specification for Secure Android Mobile Software Development

   https://doi.org/10.1109/DESEC.2018.8625114  

   Qian, Kai; Parizi, Reza M.; Lo, Dan (December 2018, 2018 IEEE Conference on Dependable and Secure Computing (DSC))

   The security threats to mobile applications are growing explosively. Mobile apps flaws and security defects open doors for hackers to break in and access sensitive information. Defensive requirements analysis should be an integral part of secure mobile SDLC. Developers need to consider the information confidentiality and data integrity, to verify the security early in the development lifecycle rather than fixing the security holes after attacking and data leaks take place. Early eliminating known security vulnerabilities will help developers increase the security of apps and reduce the likelihood of exploitation. However, many software developers lack the necessary security knowledge and skills at the development stage, and that's why Secure Mobile Software Development education is very necessary for mobile software engineers. In this paper, we propose a guided security requirement analysis based on OWASP Mobile Top ten security risk recommendations for Android mobile software development and its traceability of the developmental controls in SDLC. Building secure apps immune to the OWASP Mobile Top ten risks would be an effective approach to provide very useful mobile security guidelines. 

   more » « less
5. Mobile Software Security with Dynamic Analysis

   https://doi.org/10.1109/PRDC.2018.00039  

   Shahriar, Hossain; Qian, Kai; Talukder, Md Arabin; Lo, Dan; Patel, Nidhibahen (December 2018, Proc. of the 23rd IEEE Pacific Rim International Symposium on Dependable Computing (PRDC))

   The majority of malicious mobile attacks take advantage of vulnerabilities in mobile software (applications), such as sensitive data leakage, unsecured sensitive data storage, data transmission, and many others. Most of these vulnerabilities can be detected by analyzing the mobile software. In this paper, we describe a tainted dataflow approach to detect mobile software security vulnerability, particularly, SQL Injection. 

   more » « less