Appendix
Taken from Security Guidance for Critical Areas of Mobile Computing, V1.0
The following are countermeasures to mitigate major authentication threats as described in the attack trees below. The threat is followed by the countermeasures. Some are security policy elements, which can be implemented by device administrators, some can only be addressed by app developers, and some can only be addressed by OS developers.
Authentication Bypass
The most common methods of authentication bypass are all possible because of developer errors. However, an enterprise information technology department can test software for vulnerabilities.
▪ SQL Injection—Implement escaping of reserved SQL words and characters such as ‘, =, OR, etc.
▪ Direct URL request—Access ...