Smartphone App Security: Breaking and Building Secure Apps

FIRST Hands-On Classes (Room Kenshu)

Thursday — November 15th, 2012 10:00

Thursday — November 15th, 2012 11:00

Thursday — November 15th, 2012 11:15

This class looks at the unique security problems faced by application developers writing code for today’s mobile platforms. In this first of our smart phone series, we take a close look at Apple?s iOS and Google’s Android. The class presents a clear and practical view of the problems, how they can be attacked, as well as remediation steps against the various attacks. It is heavily hands-on driven to not just describe but demonstrate both the problems and the solutions available.

Requirement

For the Android portion of the class, students will need a laptop with the ability to run a virtual machine using Virtual Box. They should have a minimum of 4 Gb RAM, and 10 Gb disk space available. Current Windows or OS X will work. (If they run Windows XP, they need to install driver (free from Microsoft) for exFAT file systems.) For iOS portion, they will need Lion or Mountain Lion OS X, with current XCode dev environment installed, including command line tools (an optional but free add-on from Apple). Here too, I recommend a minimum of 4 Gb RAM and about 10 Gb disk space available.

Presenters

• Ken Van Wyk (KRvW Associates, LLC)

  Ken is a CERT® Certified Computer Security Incident Handler, as well as an internationally recognized information security expert and author of the popular O'Reilly and Associates books, Incident Response and Secure Coding: Principles and Practices, as well as a monthly columnist for Computerworld. Among his numerous professional roles, Ken is a Visiting Scientist at the Software Engineering Institute at Carnegie Mellon University, where he is a course instructor and consultant to the CERT® Coordination Center.

  Ken has previously held senior information security technologist roles at Tekmark's Technology Risk Management practice, Para-Protect Services, Inc., and Science Applications International Corporation (SAIC). Ken was also the Operations Chief for the U.S. Defense Information Systems Agency's DoD-CERT incident response team, as well as a founding employee of the CERT® Coordination Center at Carnegie Mellon University's Software Engineering Institute.

  Ken has previously served as the Chairman and as a member of the Steering Committee for the Forum of Incident Response and Security Teams (FIRST), a non-profit professional organization supporting the incident response community. He currently sits on their Steering Committee and Board of Directors. He holds a mechanical engineering degree from Lehigh University and is a frequent speaker at technical conferences, including S3, CSI, ISF, and others FIRST.