+APP.1.4 Mobile Applications (Apps)
---+APP.1.4.G1. Inappropriate Selection of apps
---+APP.1.4.G2. Excessive Authorisations
---+APP.1.4.G3. Undesired Functions in Apps
---+APP.1.4.G4. Software Vulnerabilities and Errors in Apps
---+APP.1.4.G5. Insecure storage of local application data
---+APP.1.4.G6. Deriving Confidential Information from Metadata
---+APP.1.4.G7. Leaks of Confidential Data
---+APP.1.4.G8. Insecure Communication with Back-End Systems
---+APP.1.4.G9. Communication Channels Beyond an Organisation’s Infrastructure
---+APP.1.4.A1 Requirements Analysis for the Use of Apps [Process Owner] (B)
---+APP.1.4.A5 Minimising and Checking App Authorisations [Process Owner] (B)
---+APP.1.4.A7 Secure Storage of Local App Data (B)
---+APP.1.4.A8 Preventing Data Leaks (B)
---+APP.1.4.A3 Distributing Sensitive Apps (S)
---+APP.1.4.A12 Secure App Removal (S)
---+APP.1.4.A14 Support for Additional Authentication Features for Apps (H)
---+APP.1.4.A15 Performing Penetration Tests for Apps (H)
---+APP.1.4.A16 Mobile Application Management (H)

APP.1.4 Mobile Applications (Apps)

Introduction

Today, smartphones, tablets, and similar mobile devices are also widely used by public authorities and companies. Employees can use them to access their organisation's data and other information and applications at any time regardless of where they are.

Mobile applications (or "apps") are installed and executed on the operating systems used on mobile devices, such as iOS or Android. Apps are usually obtained from app stores. These are operated and maintained by the manufacturers of the operating systems used on mobile devices. In professional environments, however, it is also common for an organisation to develop its own apps and install and manage them on end devices using mobile device management (MDM) solutions. Compared to applications on desktop operating systems, iOS or Android apps are subject to special framework conditions, such as the authorisation management ensured by the operating system.

There is now a large selection of available apps for different mobile operating systems. There are also standardised libraries and development environments that enable apps to be developed quickly compared to conventional applications.

Objective

The objective of this module is to protect information that is processed with apps on mobile end devices. It also covers the integration of apps into existing IT infrastructure. The module defines requirements for the proper selection and secure operation of apps, regardless of whether they are obtained from an app store or installed by an organisation on its own.

Scoping and Modelling

Module APP.1.4 Mobile Applications (Apps) must be applied to all applications that are used on mobile devices.

The module covers apps on mobile operating systems such as iOS and Android. Requirements that affect the underlying operating systems are not considered here. These requirements are covered, for example, in the modules SYS.3.2.3 iOS (for Enterprise) and SYS.3.2.4 Android. Apps are often managed centrally in a mobile device management system. The requirements for such systems are covered in module SYS.3.2.2 Mobile Device Management (MDM).

Similarly, the aspects of specific apps are not discussed in this module. These are covered in the corresponding modules of the APP layer (Applications), such as APP.1.2 Web Browsers.

Apps often rely on back-end systems or server/application services. For cases in which an organisation operates these back-end systems or servers on its own, please refer to the corresponding modules of the IT-Grundschutz Compendium for security recommendations. These include, for example, APP.3.1 Web Applications and Web Services and APP.4.3 Relational Database Systems. Modules dealing with general aspects of applications, such as OPS.1.1.6 Software Tests and Approvals or APP.6 General Software, should also be considered, as these aspects are not covered in this module. The requirements of module CON.8 Software Development should be considered when developing in-house apps.

Useful Resources

Germany’s digital association, Bitkom, has published a decision-making aid for apps and mobile services in companies in the guide entitled “Apps & Mobile Services – Tipps für Unternehmen” [Apps & Mobile Services - Tips for Companies] (2nd edition, 2014).

The Information Security Forum (ISF) has published a paper entitled “Securing Mobile Apps – Embracing Mobile, Balancing Control” (2018).

“NIST Special Publication 800-163: Vetting the Security of Mobile Applications” (2015) also provides extensive information on apps.

1. Übersicht

APP.1.4.A1 Requirements Analysis for the Use of Apps [Process Owner] (B)

During requirements analysis, risks arising from mobile use in particular MUST be considered. The organisation MUST verify that its ability to check and influence the operating system environment of mobile devices is sufficient to facilitate their secure use.
APP.1.4.A5 Minimising and Checking App Authorisations [Process Owner] (B)

Security-relevant authorisation settings MUST be established so that they cannot be changed by users or apps. If this is not technically possible, the authorisation settings MUST be regularly checked and reset.

Before an app is introduced in an organisation, it MUST be ensured that it only has the minimum app authorisations required for its function. Authorisations that are not absolutely necessary MUST be scrutinised and, if necessary, disabled.
APP.1.4.A7 Secure Storage of Local App Data (B)

If apps can access an organisation's internal documents, it MUST be ensured that the local data storage of the app is adequately secured. In particular, access keys MUST be stored in an encrypted form. In addition, a mobile device's operating system MUST NOT be allowed to cache confidential data in other locations.
APP.1.4.A8 Preventing Data Leaks (B)

To prevent unintended instances of apps transmitting confidential data or this data being used to create profiles of users, app communication MUST be appropriately restricted. To this end, communication SHOULD be analysed as part of the testing and approval procedure. Checks SHOULD also be carried out to determine whether an app is writing unwanted log or auxiliary files that may contain confidential information.
APP.1.4.A3 Distributing Sensitive Apps (S)

Apps developed within an organisation and apps that process sensitive information SHOULD be distributed through the organisation's own app store or MDM solution.
APP.1.4.A12 Secure App Removal (S)

When an app is uninstalled, the data it has stored on external systems (such as those operated by the app provider) SHOULD also be deleted.
APP.1.4.A14 Support for Additional Authentication Features for Apps (H)

Whenever possible, a second factor SHOULD be employed for user authentication in apps. Here, it SHOULD be ensured that any required sensors or interfaces are present in all the devices used. In addition, biometric procedures SHOULD take into account how resistant the corresponding authentication is to possible forgery attempts.
APP.1.4.A15 Performing Penetration Tests for Apps (H)

Before an app is approved for use, a penetration test SHOULD be performed. All communication interfaces to back-end systems, as well as the local storage of data, SHOULD be examined for possible vulnerabilities. The penetration tests SHOULD be repeated regularly and when major changes are made to the app.
APP.1.4.A16 Mobile Application Management (H)

Whenever possible, a mobile application management solution SHOULD be used for the central configuration of business apps.

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
includes APP.1.4.G1. Inappropriate Selection of apps
includes APP.1.4.G2. Excessive Authorisations
includes APP.1.4.G3. Undesired Functions in Apps
includes APP.1.4.G4. Software Vulnerabilities and Errors in Apps
includes APP.1.4.G5. Insecure storage of local application data
includes APP.1.4.G6. Deriving Confidential Information from Metadata
includes APP.1.4.G7. Leaks of Confidential Data
includes APP.1.4.G8. Insecure Communication with Back-End Systems
includes APP.1.4.G9. Communication Channels Beyond an Organisation’s Infrastructure