Mobile Security Is Not Just About the App; It Is About the Device and the User
Key takeaway: A mobile app’s security is not just about the app’s own code — it runs on a device the user controls, in an environment the developer does not fully control, and security must account for the device, the network, and the user, not just the app itself.
Why Mobile Security Is Different
A mobile app runs in an environment the developer does not fully control. The device is owned and controlled by the user, who may have rooted or jailbroken it, installed other apps, or connected to untrusted networks. The app’s data and communications are exposed to this environment, and security must account for it.
This is different from a server, which the developer controls and protects. A mobile app’s code, data, and communications are all on a device the developer does not control, which means the threat model is different and the security measures must be different.
The Threats a Mobile App Faces
| Threat | What it means |
|---|---|
| Device compromise | A rooted or jailbroken device exposes app data |
| Untrusted networks | Data in transit can be intercepted |
| Reverse engineering | App code and secrets can be extracted |
| Malicious apps | Other apps on the device can access data |
The threats include a compromised device exposing the app’s data, untrusted networks intercepting data in transit, reverse engineering extracting the app’s code and secrets, and other apps on the device accessing data they should not. Each of these is a real risk that the app’s security must account for.
What This Means for Security Design
Designing for mobile security means not trusting the device or the environment — encrypting data at rest so it is not exposed if the device is compromised, using secure communication so data is not intercepted in transit, not storing secrets in the app where they can be extracted, and protecting data from other apps on the device.
It also means recognising the limits of what the app can do — an app cannot fully protect data on a compromised device, so the design should minimise what is stored on the device and what is exposed, and treat the device as untrusted.
The Role of the User
The user is also part of the security model — the app’s security depends on the user’s behaviour, such as keeping the device updated and using a secure lock. The app can encourage good security behaviour, but it cannot control it, so the design should not depend on the user doing the right thing.
The Bottom Line
Design mobile security for an environment the developer does not control, since the app runs on a device the user controls and faces threats from the device, the network, and other apps. Encrypt data at rest, use secure communication, do not store secrets in the app, and minimise what is stored on the device, treating the device as untrusted and recognising that the app cannot fully protect data on a compromised device.
