Mobile Security · OWASP MASTG · iOS, Android

Mobile Application
Audit

The Mobile Application Security Audit detects security deficiencies and vulnerabilities in corporate applications for iOS and Android. We simulate the actual behavior of an attacker who, without having access to the source code, attempts to compromise the application and the data it manages.

Analysis
Functional and technical study of the mobile application
Audit
Security testing according to OWASP MASTG / MASVS
Documentation
Executive and technical report with risk classification
Service

What is a Mobile Application Security Audit?

Mobile applications have become an essential channel for organizations to offer services, interact with their customers, and manage critical information. This growing dependency makes the security of applications and the communications they establish with other systems a key aspect for protecting data and business continuity.

Our mobile application audit aims to identify vulnerabilities and weaknesses that could be exploited by an attacker to compromise application security, user data, or corporate systems.

The tests are performed following a black-box methodology, which means the application's source code is not analyzed. In this way, we simulate the behavior of a real attacker attempting to identify and exploit vulnerabilities using only publicly available information and access.

This approach allows for a realistic assessment of the application's level of exposure and determination of the impact an attack could have on the organization and its users.

To carry out the audit of corporate applications, we divide the process into several phases:

Functional Analysis
A general study of the application is conducted to acquire a global view of the functionalities it provides, in order to propose the optimal actions and procedures to be carried out in the Technical Analysis.
Technical Analysis
The application is analyzed so that it can be determined which types of attacks it is susceptible to.
Test Design
In this phase, the tests to be performed are designed to exploit any security deficiencies that may appear in the audited application.
Test Development
The tests to be executed will be programmed, and the order in which they will be carried out will be determined.
Test Execution
During this phase, all tests are performed on the audited application, the results obtained are analyzed, and if new vulnerabilities to exploit are detected, the process returns to the design phase to attempt to exploit them.
Our services

How we work

01Tests for Information Gathering
  • Analysis of the requirements necessary for the Audit
  • Analysis of communication requirements.
  • Analysis of the application's functionalities and/or features.
  • Analysis of the application's software architecture.
02Tests for Static Analysis
  • Necessary requirements for the code audit.
  • Review of the authentication process.
  • Review of information storage methods.
  • Management of secure communications.
  • Search for accessible sensitive information.
03Tests for Dynamic Analysis
  • Client-side app analysis.
  • Communications-level analysis.
  • Server or backend API-level analysis.
04Results
After the tests are executed, the results obtained are analyzed and the associated documentation is generated.
  • Executive summary of the audit results.
  • Results obtained from the different tests conducted, identifying the security issues found and specifying the conditions under which they were found, so that they can be reproduced (as far as possible) to facilitate their location and resolution.
  • Recommendations for resolving the security issues found in the most effective way.
  • Classification of the detected security issues according to their level of danger.
Related Services
Web Application Security Audit API Security Audit Penetration Testing Red Team exercises ASV scans Source Code Audit

Scope of service

What this service covers

Data collection

Audit requirements, communication requirements, and software functionalities and architecture of the application.

Static analysis

Requirements for code audit, authentication process, data storage, and secure communications.

Dynamic analysis

Client-side app, communications, and server or backend API level testing.

Black-box methodology

Simulation of a real attacker attempting to exploit vulnerabilities using only publicly available information and access.

Sensitive information and communications

Search for accessible sensitive information and analysis of application communications with other systems.

Results

Executive summary, reproducible results, recommendations, and classification of issues according to their severity.

What our clients say

Organizations that trust us

Working with Internet Security Auditors has been a highly satisfactory experience. Their support in migrating to the ISO/IEC 27001:2022 standard, conducting internal audits, and the PCI DSS certification process has been fundamental to strengthening our information security management system.

Ricardo Andrés Cárdenas Galvis
Information Security Office · Neurona

The strategic support of Internet Security Auditors as CISOaaS has been fundamental in strengthening our internal team. Their expertise perfectly complements our CISO's work and has allowed us to accelerate the maturity of our cybersecurity.

CISO
RACC

On behalf of Outsourcing SAS BIC, we would like to express our gratitude for your commitment and dedication during the implementation of PCI DSS compliance in our call center. We succeeded in establishing a secure environment in accordance with the most demanding requirements of the payment industry.

Yulian Colmenares
Information Security Office · Outsourcing SAS BIC

Working with Internet Security Auditors has been a positive experience in every respect. Their team combines solid technical expertise with a great willingness to collaborate, which has strengthened our security posture and regulatory compliance.

Andrés Mejía
Head of GRC · Payválida

As CFO of Saint Louis University – Madrid Campus, I have had the opportunity to work with Internet Security Auditors. They have been our indispensable partner in implementing the requirements set forth by GDPR regulations. I would like to highlight their availability to resolve questions and their ability to develop a legal framework with concrete and understandable actions…

Victoria Villarreal Palazón
Vice President & Associate VP CFO · Saint Louis University

As CFO of Fleurop - Interflora Spain, we have been working with Internet Security Auditors for years in the areas of consulting and GDPR compliance. As Interflora is a company 100% oriented towards online commerce, the professional services provided by Internet Security Auditors give us support, security, and the peace of mind that all of our activity is aligned with GDPR compliance.

Francisco Tébar Prada
CFO Southern Europe · Fleurop - Interflora Spain

As CISO at Intaremit S.A., we place the highest importance on logical security. This is not only due to the mere fact that PCI-CPP regulations require us to conduct 4 internal and external vulnerability scans and an annual internal and external pen-test, but also because of the security and peace of mind our company wishes to provide to each and every one of our clients. We have been working and collaborating with Internet Security Auditors for over 10 years due to their experience, commitment, and accessibility; therefore, I recommend them without hesitation.

Sergio Sainz de la Maza
CISO · Intaremit

At Grupo Arbulu, we have collaborated closely with Internet Security Auditors on the implementation of advanced cybersecurity measures. Thanks to their expertise, we have significantly improved our ability to detect and mitigate cyber risks. Their comprehensive audits and customized solutions have strengthened our security infrastructure, ensuring the protection of our data and the continuity of our operations.

Marcos Montes de Oca
CIO · Arbulu Group

As CEO of Beruby, we worked with Internet Security Auditors when we had to urgently perform a PCI DSS Attestation of Compliance. The entire process was extremely fast, efficient, and professional. Their team provided us with excellent support, demonstrating great technical knowledge and commitment. We undoubtedly recommend their services to any company in need of cybersecurity solutions.

Miguel Acosta
Global CEO · Beruby

At Grupo AR, we highly value the brand protection service from Internet Security Auditors for its comprehensive and proactive approach. Their highly qualified team allows us to identify and mitigate risks that could affect the AR Construcciones brand and its various companies.

Nestor Ivan Melo Ballen
Cybersecurity Director · AR Group

FAQ

Frequently Asked Questions

Which mobile platforms do you audit?

We audit iOS and Android applications, whether native, hybrid, or cross-platform (React Native, Flutter, Xamarin, etc.). Our team has experience with all types of mobile technologies.

Is the application's source code reviewed?

The mobile application audit follows a black-box methodology: the source code is not audited. The actions of a real attacker are simulated. If you require a source code review, we offer a Code Review service as a complementary service.

Do you need a physical device, or can it be audited on an emulator?

We preferably use physical devices for testing, as some security controls (biometrics, certificate pinning, Secure Enclave) cannot be fully evaluated on emulators. However, some of the testing can be performed on emulators if necessary.

What methodology do you follow?

Our methodology is based on the OWASP MASTG (Mobile Application Security Testing Guide) and MASVS (Mobile Application Security Verification Standard), complemented by our own techniques and tools. We cover all mobile security categories defined by OWASP.

Can applications that are not published in the stores be audited?

Yes. We can audit applications that are distributed internally, in the pre-production phase, or distributed via MDM. We only need the application file (APK/IPA) or access to the test environment.

Contact

Do you need to audit the security of your mobile application?

Tell us your situation and our team will get in touch with you to provide guidance or schedule a technical call.

Offices
Barcelona, Madrid, Bogotá
R
Ricardo Andrés Cárdenas
2 months ago

Working with Internet Security Auditors has been a highly satisfactory experience. Their support during the migration to ISO/IEC 27001:2022 and the PCI DSS certification process has been fundamental to strengthening our ISMS.

A
Andrés Mejía
3 months ago

Your team combines solid technical expertise with a great willingness for collaborative work, which has strengthened our security posture and regulatory compliance.

V
Victoria Villarreal Palazón
4 months ago

They have been our indispensable partner for the implementation of GDPR requirements. I would highlight their availability to resolve questions and their ability to develop a legal framework with concrete and understandable actions.

M
Miguel Acosta
5 months ago

The entire PCI DSS Attestation of Compliance process was extremely fast, efficient, and professional. We undoubtedly recommend your services to any company in need of cybersecurity solutions.

S
Sergio Sainz de la Maza
6 months ago

We have been working with Internet Security Auditors for over 10 years due to their experience, commitment, and accessibility. I recommend them without hesitation.

Request information

We will contact you as soon as possible.
Global Presence

Our offices

Barcelona

C. Santander, 101. Building A-2
E-08030 Barcelona (Spain)

+34 93 305 13 18
Madrid

Arequipa St., 1
28043 Madrid (Spain)

+34 91 763 40 47
Bogotá

Transversal 22 # 98-82, Porta 100 Building, Office 1003
110221 Bogotá (Colombia)

+57 601 638 68 88
25
years of experience in cybersecurity
Contact us