Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I'm starting to introduce mobile web apps to my company but my not-so-techie boss is worried about web security issues on mobile devices.

I'm new in the mobile world but as a web developer I know the basics about web security (like the best practices listed in OWASP) but I don't know if there's anything else that could make my mobile web app vulnerable specifically for mobile web browsers.

Also, I need an internet article readable from not-so-techie bosses that could help me convince him how secure our mobile web app could be if I apply the common web security best practices.

Can you help me with this?

PS. I'm using Java as my backend and jQuery Mobile as my frontend.

share|improve this question
    
Why do you think there will be more security issues on a mobile browser, than on a regular browser? T –  Dofs Jan 31 '12 at 19:14
    
Because on a mobile browser a regular user can be less aware of attacks like Phishing, XSS, cookie stealing through public WiFi spots or man in the middle. They cannot also be sure they are going on an SSL enabled connection or what could happen with the session if they leave the page open on the mobile browser app. They are almost the same attacks someone could do on a regular web app but since the regular users have less control on the mobile browser they tend to fear. I'm just trying to find popular articles about mobile security to calm them down. –  Roberto Linares Feb 2 '12 at 5:14

2 Answers 2

For blog posts, Google Online Security is perhaps a good place to start (link at the bottom). Also check out "Krebs On Security" - he's a journalist, not technical, so his standard of writing is excellent.

As I'm sure you know, being good at web security -mostly- lies in stuff like protecting against the basics and there is no substitute for having your software regularly audited and pen-tested by professionals. Preparing a rough and ready cost-benefit analysis for your boss might be useful in getting sign-off.

Krebs on Security: https://krebsonsecurity.com/

Google Online Security Blog: http://googleonlinesecurity.blogspot.com/

share|improve this answer
    
Thanks! they seem very good and well documented blogs, so are a good place to start my search. –  Roberto Linares Feb 11 '12 at 1:52

Your scenario has little to do with mobile web security and more to do with plain old fashioned remote access to stuff that used to be locked behind the old corporate firewall. So the same issues apply by and large. Mobile just adds some interesting wrinkles -- like spotty VPN support and higher chance of loss or theft of device.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.