Category: Blog, Mobile Commerce, Business, Development • 2 October 2020

How to Secure Your Mobile Commerce App | Guide for App Owners

To make your mobile commerce app secure, you need to act on many different fronts. Find out why securing your mobile commerce app is so important, and how to do it.

Kinga Wilczek

iOS Developer

LinkedIn
Mobile Commerce Security

How to develop a highly secured m-commerce app for my store? This is one of the most common questions we hear from our clients. M-commerce is gaining traction on the market as more and more users want to buy things using mobile devices, such as tablets and smartphones. Mobile commerce applications are processing more data than ever, including sensitive information regarding users and transactions.

This is why security has become such a key concern for business owners who invest in m-commerce apps. Every security breach can potentially cause users to abandon the application and stop considering a brand as trustworthy.

To make an app secure, you need to act on many different fronts. In this article, we share essential knowledge about m-commerce security that every app owner should know. Read on to find out why securing your m-commerce app is so important – and how to do it.

Skip to a section:

  1. M-commerce security – an overview
  2. Why is mobile commerce security crucial for your business?
  3. Security threats in m-commerce
  4. 20 best practices for securing your mobile commerce
  5. Other m-commerce security aspects to consider
  6. How to develop a highly secured m-commerce app for your store – key takeaways

M-commerce security – an overview

Let’s start with the basics. What is mobile commerce?

Mobile commerce (also called mCommerce or m-commerce) covers any transactions carried out using a mobile device (a smartphone, tablet, or even a wearable device). Examples of m-commerce include shopping apps, in-app payments, and digital content purchases. Read more: What is mCommerce? Definition and Types of Mobile Commerce.

Today, consumers use mobile apps to order and pay for services and items – for instance, meals, cleaning services, or rides. Because of this, mobile commerce is often considered the next level of e-commerce, bringing the ease of online ordering and purchasing to the comforts of mobile devices.

How does security fit into all this?

Since mobile devices are now handling an increasing volume of transactions, the question of security has become paramount to businesses looking to step into e-commerce. Ensuring the security of sensitive data is essential to winning the trust of customers and building a solid reputation. This is especially true for sectors that deal with a lot of such data, with financial services and healthcare being key examples. Read also:

Since these transactions are handled on mobile devices and over the internet, m-commerce is considered to create more security concerns than traditional e-commerce. Read on to find out why.

Why is mobile commerce security crucial for your business?

Securing your m-commerce is important for various business reasons:

  1. As a provider of mobile transactions, you’re partially responsible for securing yourself against chargebacks and ensuring the safety of your data (both that of the business and customers).
  2. A security breach might cause users to abandon your application, dropping your engagement rates, and stopping your revenue stream.
  3. Security problems are going to impact the trust customers place in your brand.

It’s impossible to guarantee 100% data security coverage. No cipher is unbreakable. Does this mean that your business data may be exposed or breached? Not exactly.

The goal here is to make sure that your security measures slow down attackers long enough to make your app an unattractive target in the first place.

How long does this take? The answer usually depends on a case-by-case basis.

Example scenario: Take access to tokens as an example. An access token is a substitute for user credentials, stating that the user had passed the correct data before. If the token expires after a month and the attacker needs more time than a month to get it, we can consider the access token as secure. The user will get a newly-generated token. The old one will no longer be usable.

To develop a highly secured m-commerce system, you need to make all breach vectors difficult enough for the hacker. However, you don’t want to force the user to sign in for every session or input their payment data every time they make a purchase. This could impact the user experience negatively and cause users to abandon the app.

You need to achieve a balance between creating a safe environment for completing online payments on mobile devices and keeping the user experience as good as possible.

Read also: 9 Key Advantages of Mobile Commerce for Businesses (+ 3 Challenges)

Security threats in m-commerce

Every mobile commerce transaction is made of three parts, with each raising its own security issue:

  • the user (the person making a purchase),
  • the server (the business that owns the app),
  • the connection (the technology that brings the two above components together).

Business owners should do their best to build a security matrix* that identifies risks and vulnerabilities accurately. This is how they can target security solutions that work for their unique requirements.

* A security matrix defines how users can interact with each level of data in your application.

So, what kind of security threats should a mobile app owner know? Here are five key threats present in today’s landscape:

  • Connection – this part of an m-commerce application is the easiest one to compromise. Hackers can cause data leakages of sensitive user data or business data that could harm your company. How can you deal with it? Check out the tips listed below in the paragraph “20 best practices for securing mobile commerce”. Hint: combining Transport Layer Security (TLS) with certificate pinning makes accessing the data very hard.
  • Payments – a lack of security here could have many terrible consequences. For example, a compromised payment gateway could cause the user to pay someone else instead of your store. You will never see the money, and they will never get the product – with your reputation on the line.
  • Keyboard – if the user downloads a third-party keyboard, the content they type can be intercepted. Prevent users from using keyboards that aren’t part of their device’s operating systems by disabling this option.
  • Copying content to your application – here’s a common scenario: we store a long password in notes (disclaimer: we definitely don’t recommend that!), so once we need to use it, we simply copy it from our notes and then use it to access an app or website. Others might have access to the clipboard and intercept your password. You can notify users when clipboard content is used or send a properly formatted message with a code that is automatically placed in the password field.
  • Files saved in device memory – if someone gets a chance to use another user’s device, and your application saves its files in a public place, it’s easy to access this data. Avoid saving sensitive data in unencrypted device memory or the cache.

Read also:

20 best practices for securing your mobile commerce

How to secure your mobile commerce? Now that we’ve defined what m-commerce security means, we can zoom in on the most exposed security holes in our app. To find them, we need to change our perspective. A mobile app is a part of a complex system that includes:

  • The mobile app itself,
  • The backend (processing client requests, storing data),
  • Third-party software (analytics, payment provider),
  • The end-user (the center of your product).

The communication between these pieces of the system might need to be secured as well. Here’s a breakdown of key best practices per each area of interest:

Mobile – backend communication security tips

Use mobile-specific solutions

We can trust users more when they create an account using phone verification. Moreover, this method is more convenient for mobile apps than email, which requires opening another app/web browser.

Secure apps have additional tokens to ensure that communication comes from the mobile app. Advanced hackers might obtain these keys, but they should definitely stop some wannabes from spoofing or performing other malicious actions. We can slow this process down by hashing the keys. However, this makes the app development process and maintenance harder.

Refresh session

We can shorten the life of access tokens to several minutes and still keep the app user-friendly by introducing refresh tokens. These tokens have longer validity than access tokens and can be used to obtain a new one. Even if an attacker acquires the access token, it will soon be useless.

Log out request

We can invalidate tokens that are no longer used by signaling to the backend that we closed the session. It’s an optional step and works similarly to the ones above.

Use Transport Layer Security (TLS)

This is a must-have for all new apps. It creates an end-to-end encryption, ensuring that nobody reads our messages even if we send them through an unencrypted channel (for example, a WiFi access point without a password). Note that there are still some steps to be solved here to make it highly secure.

Remember about certificate pinning

The solution above (TLS) will not prevent MITM (Man In The Middle) attacks. In this type of attack, the cybercriminal acts like the backend, so all messages are intercepted and read. To prevent that, we can set only a few trusted certificates used for encryption with the server.

That method has one disadvantage. Since a certificate has its expiry date, developers must publish the app update with a new one before the old one expires. Otherwise, the app will not be usable. In some situations, certificate pinning is impossible or hard to maintain (connecting to some other server). We can address this with the help of the proxy server (proxying).

Avoid sending too much information

We can make it harder for the attacker to obtain all personal data by not sending unnecessary data or splitting them to many requests. Even if the attacker intercepts one request, the information stolen might not be sufficient for them to cause any harm.

Mobile app security tips

Take care of what you store on user devices

Assume that unencrypted data on a mobile device can be stolen. Any sensitive information that needs to be stored should be encrypted. Phones have already implemented secure storage for sensitive data.

We should also remove all unnecessary, temporary files as soon as possible. An app uses many tools that cache data by default. It’s best to avoid storing sensitive data in those places, too.

Use biometric authentication

Most devices support biometric authentication today. We can use it as a convenient method of access or additional security layer for confidential data. But we should never rely only on this alone. Authentication works using something we have, something we are, or something we know. A secure mechanism contains at least two of them.

Don’t forget about binary safety

Compilers can additionally reinforce the app against attempts to intercept data from the compiled source code. This prevents some attackers from spoofing attacks or learning about the app’s security flaws. A platform SDK already includes these tools, but they might not be enabled by default.

Update your libraries

Mobile systems and libraries receive updates, so the app should be up to date as well. We can prevent many attacks just by updating libraries to their newest versions and releasing them in the app update. Most of the successful attacks were achieved by exploiting an unpatched bug that had been announced to the public at least a few months prior.

Watch out for system capabilities

Some capabilities, like clipboards, can store data across all applications. There exist apps or websites that can steal data from the clipboard or place their tracking data there. Since iOS 14, the user will see every clipboard use, which helps to prevent some harmful activity. We should also consider if the app should share data with other apps – for example: can we permit a third-party app to open an unsupported file for preview?

Third-party dependencies security tips

Third-party dependencies gather lots of data, which could be a possible security risk. Keeping user data anonymous and usable for analytics is a complex task and how you do it depends on a particular app domain.

Make sure your dependency is safe

A dependency can be an incredible time-saver and can increase your m-commerce reliability. On the other hand, dependency overuse can lead to a data breach. There is a known case where a popular JavaScript library (over 2 million downloads per week!) was hacked to steal cryptocurrency from wallet apps. This example illustrates a potential threat to mobile apps as well, since JavaScript code and various associated libraries are used in mobile development, thanks to technologies like React Native.

Keep payments secure

We almost always need a payment provider for transactions. Keeping them secure and convenient requires a lot of effort. Many business owners depend on such third-party providers. It’s a great idea to offer handy methods like Google Pay or Apple Pay.

Choose reliable Analytics solutions and ads SDKs

To secure your m-commerce app, choose a reliable analytics tool or advertisement SDK. Be sure to check if the provider experienced any cybersecurity problems like data leakage recently. What’s the company’s reputation? Do large organizations use this tool? Your development team should assess it and tell you whether it’s a good match. The tool can always be audited by cybersecurity experts for final verification.

Read also: Pros and cons of using 3-rd party software in your application development

Other m-commerce security aspects to consider

Let’s say that you already have an application with a military-grade security level. Unfortunately, this is not enough. You should consider these two issues: User Experience (UX) and legal compliance.

User Experience (UX)

  • Don’t make the app too complicated for the user – remember, an m-commerce app isn’t an online banking app, so there’s no need to log the user out every 10 minutes. Such restrictions will make the app complicated and far from user-friendly. People might leave and find a more convenient way to realize their goals.
  • Follow guidelines – every mobile platform offers guidelines that include many useful tips related to the user interface and experience. They explain how to create app authentication and authorization steps in a user-friendly way.
  • Use built-in tools – iOS and Android offer some built-in solutions which can both improve experience and security. These include payment methods (Apple Pay, Google Play, in-app purchases) and sign in methods (sign in with Apple/Google). These methods require almost no action from the user – instead of filling complicated forms, the app uses the data already present on the device.
  • Look at what the big tech companies are doing – they have already solved many problems related to both security and user interface. They may have even open-sourced some of them.

Legal compliance

  • US Export Law – you can’t use some cryptographic algorithms in countries with export restrictions. Moreover, some device features might not be available in selected regions. Targeting those regions requires some substitutes or using a different app.
  • Apple/Google developer agreements – Apple App Store and Google Play Store require that users know what happens with user data and how they are processed. You should share this information in the app description or privacy policy.
  • Internal policies – smart internal policies may prevent phishing and other social attacks on users. One of them is never asking the user about the password.
  • GDPR – the European directive enforces user data security and punishes companies that allow data leaks. The m-commerce system must grant the user the right to investigate all their data without showing someone else’s data. The user can also request data removal, which is not an easy task because things like invoices or purchase history can only be anonymized. This is why the system must implement security by design.

How to develop a highly secured m-commerce app for your store – takeaways

Security in mobile commerce app development – key takeaways:

  • Security is a continuous process that responds to new challenges and threats, especially in a fast-paced domain like m-commerce. Stay up to date with the recent regulations, technical solutions, and technologies. Look at the largest companies and the entire IT sector to find the best and most suitable solutions.
  • Remember, the user doesn’t experience good security (except in some cases), but will certainly experience a data breach. As an app owner, your decisions will determine the overall security level of the app and its balance with user experience.
  • Every third-party solution might create an additional data leak. Check the dependencies and their potential outcome before using them.
  • Even an experienced development team proficient in creating secure m-commerce apps should be assisted by an external security audit to check for possible app issues.
  • Remember to inform your customers that their data is kept safe on your mobile app. The process of transaction completion needs to be marked as secure.

We hope that now you know how to secure your m-commerce. Are you looking for a development team experienced in m-commerce app development and security? Reach out to us. We have built 130+ apps for companies around the world to help them enter the mobile successfully and safely. One of the mobile e-commerce apps we’ve developed is CCC-Shoes and Bags. f

LinkedIn