Presentation done by me and Herman Duarte in the 2nd Smart Executive Breakfast. Images credited to: https://www.flickr.com/photos/2_dogs/15608584698/in/photolist-pMh5rh-7z9ART-p7VxWx-7z9AUV-7HiJTB-7HnE4o-7Cu1Sn-7HnEbu-7HnDZm-7BvfGM-7HnDuQ-7HnDP9-7BvfCK-7HiJoM-7Bz6nf-92sk9u-BDvjQ-4Z8Kom-7B76Yv-8ZoH5N-boVMC1-qkwnSx-7bPUnN-7bPWaL-bHCJEc-7hHtiq-av98aY-7z9ANe-9FFk-dqwACQ-qXsZmm-7zdnwj-6xYN7X-7z9B2D-7z9AXV-7zdo45-7zdnZU-357Hy-9UWz6d-7uXCPC-7z9AGv-7uTNAp-7uXCYo-7uTPh8-7uXDkJ-7uTPc2-7uTN6k-7uTNiH-7uTPmi-7uXDr9 Pixabay.com Common Creative images.

1. 1
30 / 04 / 2015
/// Mobile Application (In) Security
Cláudio André
Herman Duarte

2. 2
• Enquadramento
• Componentes de uma Mobile App
• OWASP Mobile Top 10
• Exemplos práticos
• Impacto no Negócio
• Como proteger o ecossistema
• Q&A
/// Agenda
2

3. 3
/// Quem é o seu melhor amigo ?
3

4. 4 4

5. 5
/// Foi em tempos
5

6. 6 6

7. 7 7

8. 8 8

9. 9 9

10. 1010

11. 11
Cliente
11

12. 1212
Rede

13. 1313
Servidor

14. 1414

15. 1515

16. 1616

17. 1717

18. 1818

19. 1919

20. 2020

21. 2121

22. 2222

23. 2323

24. 2424

25. 25
/// M2 - Insecure Data Storage
25

26. 2626
/// M4 - Unintended Data Leakage

27. 2727
/// M6 - Broken Cryptography

28. 2828
/// M7 - Client Side Injection

29. 2929
/// M10 - Lack of Binary Protections

30. 3030
/// M10 - Lack of Binary Protections

31. 3131
/// Impacto no Negócio

32. 3232
/// Impacto no Negócio
Data Leakage

33. 3333
/// Impacto no Negócio
Data Leakage
Financial data compromise

34. 3434
/// Impacto no Negócio
Data Leakage
Identity Theft
Financial data compromise

35. 3535
/// Impacto no Negócio
Data Leakage
Identity Theft
Fraud
Financial data compromise

36. 3636
/// Impacto no Negócio
Data Leakage
Identity Theft
Fraud
Reputation Damage
Financial data compromise

37. 3737
/// Impacto no Negócio
Data Leakage
Identity Theft
Fraud
Reputation Damage
Financial data compromise
PCI Violations

38. 3838
/// Como proteger o Ecossistema

39. 39
Defense-In-Depth
39
/// Como proteger o Ecossistema

40. 40
Defense-In-Depth
40
Developer Awareness and Training
/// Como proteger o Ecossistema

41. 41
Defense-In-Depth
Secure Development Best Practises (OWASP)
41
Developer Awareness and Training
/// Como proteger o Ecossistema

42. 42
Defense-In-Depth
Secure Development Best Practises (OWASP)
Threat Modeling
42
Developer Awareness and Training
/// Como proteger o Ecossistema

43. 43
Defense-In-Depth
Secure Development Best Practises (OWASP)
Threat Modeling
Continuous Penetration Testing
43
Developer Awareness and Training
/// Como proteger o Ecossistema

44. 44
Questões ?
44