Security for iPhoneiPad Banking Apps

Apparently, according to a recent survey, "54% of Bankers Call Creating Mobile Corporate Banking Services a High Priority".

Yet their primary concern is mobile device security. Asked about the biggest barriers to growth in mobile corporate banking, 77% cited fraud and security concerns.

Having designed and led a team to build an iPhone/iPad app for a major Wall Street bank, I know first hand that this is a serious concern inside the firm.

Here are a few steps you can take: 

Don't store any sensitive information on the device. Actually we don't store anything at all, other than the login username, and this is only if the app user chooses to save this for ease of future login. Citigroup reported a security flaw in it's iPhone app in July 2010. The problem: they were storing sensitive information on the device.

Check for a jailbroken device at startup. When a device is jailbroken, you can gain full access (root access) to unlock all features of the said operating system, thereby removing limitations imposed by Apple. This means a hacker can get at the apps and the data on the device. They might even be able to decrypt your application binary and determine the logic, communication endpoints, and more.

Ensure that all external communication is secure. Use secure protocols when communicating with external bank systems (HTTPS, SSL, etc). We actually implemented an additional redirection layer on top of this.

App timeout and/or closure upon exit. In case a phone is left somewhere unlocked or let's say without a password on the device, you want to make sure someone can't just pickup the device and get to the app without providing credentials. You can employ a timeout on the app, requiring login after let's say 5 minutes of inactivity.

Apple also has an option in it's build settings called "Application does not run in background". This is in the build plist file and if checked, when the home button is pressed the application will close completely, requiring a reload. The default setting is unselected, meaning that the app stays in memory unless the device is rebooted. In this case, you had better employ some kind of timeout period requiring credentials after timeout.

Hire an external vendor to perform a penetration test. We hired a 3rd party security specialist firm to do this. They tested all communication endpoint urls as well as the protocol and the actual device. This is a relatively new area, so find a vendor that has experience with mobile device security.

Is the Playbook Enough to Save RIM

Research in Motion's new Blackberry Playbook tablet and its QNX based operating system are impressive to say the least, but are they enough to save the company from its downward slope? Some would argue yes and that the Playbook is the iPad killer. I disagree.

At one point the Blackberry platform defined the business world. Its enterprise level emailing capabilities and its solid corporate designed were the cutting edge of the smartphone community. But sadly, RIM has failed to keep up with the constant innovation of the industry. While the Blackberry's corporate offerings have remained strong, several powerful competitors have entered the playing field.

With Apple, Google, and Microsoft battling it out for market share they seem to be leaving RIM behind. This is because while all three of these platforms are competitive in the business world, they look beyond that. They look toward the casual users, the gamers, the tech enthusiasts. Because of this, RIM is struggling to hold onto its dwindling market share (14%) while Android and iOS continue to see gains (33% and 16% respectively).

You may be asking what this has to do with the Playbook. The fact is, it has everything to do with the Playbook. With Apple's iPad dominating the tablet market and Google's Honeycomb based tablets just starting to take off, where does the Playbook fit in? Does it fit in the business savvy crowd? I believe that answer is no. At launch, RIM's Playbook had no email or calendar client available for the platform (not very business oriented). What about the casual users? The Playbook has little in the way of app offerings, although it will gain access to a portion of the Android Market at a later date. This means that all the games, media, and productivity applications that smartphone and tablet users have come to expect are not present on the Playbook. So, beyond the pre-installed applications, the tablet offers little else. The media and web browsing capabilities of the Playbook are impressive, but its nothing the iPad and Honeycomb tablets can't do as well or better.

So, while RIM struggles to find its own place in the fast moving smartphone and tablet markets, the competition continues to leave them behind. The Blackberry Playbook is a great product with a ton of potential, but in this crowded market you really have to stand out. Unfortunately, this isn't something RIM excels at.

Tech Shortage Is Coming

This article is time sensitive and if your reading this a year from now in 2012 it may not be as true or true at all. If you are reading it in the summer of 2011 it is extremely important to know that the gadgets and gizmos you love so much; may soon be very hard to come by.

All the demand for amazing products such as the Canon 5D Mark 2 or the iPad2 or the N300NN security camera; combined with the devastation of the earthquake and tsunami in Japan has led to one inevitable result; an inability to get high enough quality and quantities of the chips and processors that make these amazing gadgets run.

As stock is running out on your favorite gizmos including surveillance equipment and CCTV products; we are reaching a point where the ability to get these fine items, especially in the surveillance industry, but all over the ech world is going to be harder and harder.

This is already happening as I have seen some of the most popular CCTV products reduced to only one or two left in stock with no more coming until October or November, and still in very limited quantities. With this reality and information in mind it has made some resellers and distributors stock up early, but when these supplies run out there will almost inevitably be a rise in price as the demand continues to rise with limited supply. The closer we get to June and especially July of 2011 we are going to see fewer and fewer tech products available as their supplies dwindle without quick replenishment.

Furthermore for the smaller scale tech creators it will take a longer time to restock their products as bigger named companies such as Apple, Microsoft, Sony, etc... will get higher priority.

So if you know that in the near future you are going to be needing that key piece of surveillance equipment or wanting that really cool spy gadget; you may want to look at getting it soon as it may not be available for long; and if it is available in a month or so; you may be facing a higher price than you would have otherwise. There is of course the patient route in which you can always wait the 6 months or so and get your surveillance equipment then; otherwise you may want to act fast before it's too late.