Earlier this month, Facebook reported a massive data breach that compromised the personal data of 14 million users; the breach has been traced back to a group of Facebook and Instagram spammers who were familiar with the company’s internal investigation and security policies.
The incident is one of many recent high-profile cases that has put security on the top of everyone’s mind. But security is always a priority for us: we have a duty of care to the people who use our apps.
In the context of our apps, ‘data’ usually concerns the phone or tablet itself, not the person who uses it. We don’t ask for ‘personal data’ in the way that a Facebook profile does. Even when our apps use your location in the real world to cue audio or visual content, we don’t track your location or movements. We only use personal data when a user gives us permission, and when it’s in the interest of the app experience.
However, we still need to think about security. Our apps are still stored on phones, and still move data from phone to server and back again – we need to be acutely aware of our responsibility as an app developer to handle this data with care.
Whether it‘s four hundred or fourteen million users, data security has to be the top of any app developer’s mind. Here’s how we make sure our apps stay secure, and keep our users’ data where it needs to be.
Storage on your phone
All the data our apps store is encrypted: that means it’s translated into another form or code, and it can’t be decrypted without either a password, or a ‘key’ that decrypts the data every time the app needs to read it.
Encrypting data prevents a middleman – a hacker or cyber criminal – from intercepting a message, reading it or changing it entirely. Data is encrypted at one end of the process, whether that’s saving it on your phone or sending it to a server or another device, and it’s not decrypted until it arrives.
- You may like: “It’s all about the UX” – What’s so compelling about Apps from the Calvium perspective
Perfect on-device encryption is easy to imagine, but a little harder to execute. The ideal implementation would mean nobody could access the device’s operating system without a password – even if they broke open the device, took out the memory and plugged it into something else.
iOS and Android devices are typically encrypted by default. Data is also ‘sandboxed’ behind a security layer which isolates each app from the operating system. The app can’t give itself permission to access anything – that’s why the permissions system pops up messages saying “so-and-so app would like to access your location, contacts and camera.” That prevents the app from reading data from other apps, or with the phone’s operating system, unless you’ve given the app permission. It’s on developers to make sure that their apps only request the access they need.
As developers, we can go further, putting sensitive data behind another layer of encryption within the app itself. We can also encrypt files and networking communications, so if a third party should get access to the data, they would still need to decrypt it.
Transferring data from device to server
Let’s say someone uses Facebook solely via the mobile app, and Facebook has a data breach because the server they use to store images is compromised. That’s not necessarily the app team’s fault, but it’s natural for users to blame the app – so there’s a considerable risk for app developers should a connected server turn out to be vulnerable. So although out of our control to an extent, server security is something we have to think about when designing apps.
The app developers’ influence over server security can be limited, but we can certainly make recommendations. When we design our apps, we use Transport Layer Security – a protocol that encrypts the data and demands that server and app authenticate each other before exchanging data. If there’s any problem with the ‘handshake’ between server and app, no data is exchanged: prevention, of course, being better than cure. Beyond that, we test network security using a Microsoft and IBM approved SSL tool designed by Qualys, which offers a continuous assessment of network security and compliance with security standards.
What else do we think about?
Encryption is only one of the ways we can keep data in apps secure.
Many of the points to consider are context specific, at the design level. When you develop features you have to keep privacy in mind, by limiting access to other users’ data (especially important if the app is designed to share something, as they frequently are,) and requiring users to authenticate every time they use the app, confirming that it’s really them.
Location data is something to keep an eye on – so many apps have a ‘home’ location set, or use constant real-time location tracking – and that has to stay secure, particularly in apps designed for sharing. Strava – the running and cycling app – allows users to keep their tracked runs private, and if users share a route that’s near their house, the start and end are not shared – the app will never give away where someone lives.
This isn’t to say Strava did everything right – the data they used to build their global heatmap happened to expose military bases. It’s vital to think beyond the technical functions and how the app will work – the consequence of every feature and every element of the build has to be thought through.
Encryption is an expected standard for app development. A good developer goes further, adding additional layers of security and testing the relationship between device, app and server. Beyond this, the best developers think hard about features, access and how the app is going to be used – and they make sure their apps only ask for what they really, genuinely need.
If you’re considering an app for your business, be stringent and ask your developer how they’ll keep the app secure. It’s one thing to say there were six hundred data breaches in the first half of 2018, but consider that there are over two million apps on both the Android and Apple stores. Most apps are far more secure than the headlines suggest. Data security is a cause for concern, but not fear; it shouldn’t stop an app project from going ahead.
A project like enModus’ Smart Lighting Commissioning app – where the infrastructure of a factory is hooked up to a mobile device for control – needs to keep security in mind. Our process was careful, comprehensive, and tackled the enModus team’s concerns. Find out about that app project here.
