Mobile app security: building to the OWASP MASVS standard
Mobile apps put company code and data on devices you don't control. OWASP's mobile standard breaks the problem into eight areas to test against.
A mobile app runs on a device the company doesn't own, alongside other apps it didn't vet, and can be downloaded and taken apart by anyone. Web app security practices help, but mobile adds its own risks.
The reference standard is OWASP's Mobile Application Security Verification Standard (MASVS), with its companion testing guide, the MASTG. MASVS groups its controls into eight areas.
The eight MASVS control groups
| Group | What it covers | Common failure |
|---|---|---|
| MASVS-STORAGE | Storing sensitive data on the device | Tokens or personal data in plain files or logs |
| MASVS-CRYPTO | Use of cryptography | Hard-coded keys, outdated algorithms |
| MASVS-AUTH | Authentication and authorization | Security checks done only in the app, not on the server |
| MASVS-NETWORK | Network communication | Weak TLS settings, no certificate checks |
| MASVS-PLATFORM | Interaction with the operating system and other apps | Exposed components, data leaked through clipboard or screenshots |
| MASVS-CODE | Code quality | Outdated third-party libraries, unsafe input handling |
| MASVS-RESILIENCE | Resistance to reverse engineering and tampering | Easily modified app used to bypass controls |
| MASVS-PRIVACY | User privacy | Collecting more data than needed, unclear tracking |
Where most problems are
Two patterns cause many mobile security issues. The first is trusting the app: any check done only on the device, such as whether a user is allowed to see a record or whether a purchase is valid, can be bypassed by a modified app. Authorization belongs on the server. The second is storing secrets on the device: API keys bundled in the app can be extracted, and tokens saved outside the platform's secure storage (Keychain on iOS, Keystore on Android) can be read on a compromised phone.
Testing
Use MASVS as the requirement set and the MASTG for test cases. Automated scanners check app binaries for common issues, such as insecure storage and outdated libraries. Manual testing is still needed for authentication logic and server-side checks. Resilience controls matter most for banking, payments and apps that protect content or prevent fraud.
Users are a target too
Verizon's 2026 breach report found mobile phishing gets click rates 40% higher than email phishing. Apps that send users links by SMS or messaging teach them to trust those links. Keep sensitive actions inside the app and tell users how you will and won't contact them.
What IT teams should do
- Adopt MASVS as the security requirement for every mobile app you build or commission.
- Move all authorization checks to the server, and test them with a modified app.
- Remove API keys and secrets from app bundles.
- Scan app builds for outdated libraries before every release.