Privacy and data security: how do you secure an app?

A well-secured app meets the set security standards. These standards are set at multiple levels: the EU, national, societal or in the Google Play Store and Apple App Store. Well-secured means that only authorized users have access to privacy-sensitive data. In addition, an app should never be misleading or unreliable.

As a company or app owner, securing an app is not an unnecessary luxury. If you want to avoid large fines and nasty PR issues, it is advisable to ensure that the app is properly secured. Is privacy-sensitive data collected in an app? In that case it is important to be aware of this. Both the consumer and the company have an important role to play in this. We can roughly divide app security into two categories:

1. The minimum measures for privacy assurance and data security within apps
2. Additional measures for data security in apps

The basic measures for securing important and privacy-sensitive data:

• Provide secure data traffic by only sending data with an encrypted connection. You do this through an SSL or HTTPS connection. By encrypting the data between sender and receiver, you prevent third parties from accessing this data*. Do you want to go one step further? Then add an SSL pinning or a TLS certificate (the successor to SSL). This prevents a so-called man-in-the-middle attack.
• Use only unique en strong passwords.
• encrypt en secure all data stored on a device.
• Always work with the latest software and operating system updates. Hackers or malicious parties often use older versions with problems to access systems and data. By consistently updating software, you reduce this risk.
• Which user is allowed to see which data? In other words: vshare the roles. Can this user only view data or also edit and even delete data? By dividing roles and identifying a user through a login (Facebook/Google/email) and linking it to a role, you secure the data. Take, for example, an app that we are currently developing for restaurants. We have divided this into three user roles: user, admin and owner. An owner user role can change content related to his own restaurant. An admin user role can change all data. A user can only log in to the app and leave reviews. By thinking carefully about the user roles, you protect the data within the app.
• Use layer security. This means that you provide security for every step where a hacker can enter. For convenience, compare this with a house. This is how you put a fence around your house and lock the doors with a lock.

* Did you know: nowadays it is very easy to get SSL certificates. We use for this 'let's encrypt'. Let's encrypt is a non-profit organization that encourages companies to make connections secure with HTTPS. They provide free SSL certificates, you used to have to pay for this.

If you want to go a step further, you can add some extra security layers to ensure user privacy and application security. With this you can think of:

• Awareness and attention of develop. Perhaps one of the most important aspects of developing well-secured apps. A structured, logical and clean code provides more security and overview. Security measures are maintained by applying the 'secure-coding' principles. This in turn ensures that the underlying infrastructure is properly implemented and misconfigurations and outdated software are prevented (the earlier point with basic application security)**.
• Continuous application security. By conducting consistent checks, it can be checked whether malicious parties can manipulate the underlying infrastructure, for example by entering or exchanging incorrect data. By doing this in iterations, security vulnerabilities are detected in a timely manner.
• Use OAuth 2.0. By using an OAuth workflow you give third parties secure access to the API or HTTP endpoints. This is not done via a login, but via an access code. The app then receives an access token after logging in, which is valid for a certain period of time. With that access token you can then retrieve data for a specific role (user/admin/owner etc.) for a certain period of time. The backend then checks which user is involved and whether they are allowed to access the data. See the image below for a schematic workflow of OAuth 2.0.
• The security of an app's backend should be nailed down. You can check this using the OWASP (Web Application Security Sheet).

** This often went wrong with the much-discussed corona apps. Security tests have shown that the 'secure coding' principles have not been applied sufficiently. For example, hard-coded passwords can be traced in the readable source code that has been published. This allows access to the databases and underlying infrastructure. In many cases, this infrastructure and API was not secured with identification and authentication.

Fortunately, as consumers, we are also protected against data breaches by law. The AVG law is perhaps one of the most important new laws that protects the rights and privacy of app users. Organizations that do not handle customer data carefully can be fined. In addition, reporting a data breach has been mandatory since 2016. Every organization is obliged to report a data leak or security breach to the Dutch Data Protection Authority.