Application Security for the Android Platform: Processes, Permissions, and Other Safeguards

by Jeff Six

Overview

With the Android platform fast becoming a target of malicious hackers, application security is crucial. This concise book provides the knowledge you need to design and implement robust, rugged, and secure apps for any Android device. You’ll learn how to identify and manage the risks inherent in your design, and work to minimize a hacker’s opportunity to compromise your app and steal user data.

How is the Android platform structured to handle security? What services and tools are available to help you protect data? Up until now, no single resource has provided this vital information. With this guide, you’ll learn how to address real threats to your app, whether or not you have previous experience with security issues.

• Examine Android’s architecture and security model, and how it isolates the filesystem and database
• Learn how to use Android permissions and restricted system APIs
• Explore Android component types, and learn how to secure communications in a multi-tier app
• Use cryptographic tools to protect data stored on an Android device
• Secure the data transmitted from the device to other parties, including the servers that interact with your app

Product Details

ISBN-13:	9781449322274
Publisher:	O'Reilly Media, Incorporated
Publication date:	12/01/2011
Sold by:	Barnes & Noble
Format:	eBook
Pages:	114
File size:	1 MB

About the Author

Jeff is a senior security engineer at a major financial institution based on Baltimore, Maryland, where he works to secure customer and firm data. A major component of Jeff's job is working with developers to enhance the security of applications through education, code reviews, and deployment of modern application security techniques and frameworks. He also develops security-related applications, primarily using the Java EE platform. Prior to this position and a comparable one at another financial services firm, Jeff worked at the National Security Agency on similar application security projects and development efforts, focused on information assurance. Jeff has been a member of the Adjunct Faculty at the University of Delaware since 2000, teaching an object-oriented programming with Java course for ten years and, more recently, a course on Secure Software Design. He has been a lifeguard since 1993, and an instructor since 1995. Additionally, Jeff is an amateur triathlete, competing at the sprint, Olympic, and 70.3 distances.

Table of Contents

Preface; Organization of the Book; Conventions Used in This Book; Using Code Examples; Safari® Books Online; How to Contact Us; Acknowledgments; Chapter 1: Introduction; 1.1 Application Security: Why You Should Care; 1.2 The Current State of Mobile Application Security on Android; 1.3 Security: Risk = Vulnerability + Threat + Consequences; 1.4 Evolution of Information Security: Why Applications Matter the Most; 1.5 Your Role: Protect the Data; 1.6 Secure Software Development Techniques; 1.7 Unique Characteristics of Android; 1.8 Moving On; Chapter 2: Android Architecture; 2.1 Introduction to the Android Architecture; 2.2 The Linux Security Model; 2.3 The Resulting Android Security Model; 2.4 Application Signing, Attribution, and Attestation; 2.5 Process Design; 2.6 Android Filesystem Isolation; 2.7 Android Preferences and Database Isolation; 2.8 Moving up the Layers to System API and Component Permissions; Chapter 3: Application Permissions; 3.1 Android Permission Basics; 3.2 Using Restricted System APIs and the User Experience; 3.3 Custom Permissions; Chapter 4: Component Security and Permissions; 4.1 The Types of Android Components; 4.2 Intercomponent Signaling Using Intents; 4.3 Public and Private Components; 4.4 Imposing Restrictions on Access to Components; 4.5 Putting It All Together: Securing Communications in a Multi-Tier App; Chapter 5: Protecting Stored Data; 5.1 The Threats and Vulnerabilities Against Stored Data; 5.2 Protection Principles; 5.3 Cryptography Primer: Encryption; 5.4 Cryptography Primer: Hashing; 5.5 Cryptographic Practicalities; 5.6 Key Derivation and Management; 5.7 Practical Cryptography: Applying a Technique Against a Threat; Chapter 6: Securing Server Interactions; 6.1 Confidentiality and Authentication; 6.2 SSL/TLS: The Industry Standard; 6.3 Protecting Data En Route to Public Services; 6.4 Protecting Data En Route to Private Services; 6.5 Threats Against Devices Using Data in Transit; 6.6 Input Validation: The Central Tenant of Application Security; 6.7 Preventing Command Injection; Chapter 7: Summary; 7.1 Key Themes; 7.2 Wrapping It Up;