|
Getting your Trinity Audio player ready...
|
The Cyber Security Agency of Singapore (CSA) has introduced the “Safe App Standard” as part of a significant move to bolster the security of mobile applications. This recommended standard serves as a crucial benchmark for local app developers and providers, offering guidance on essential security controls and best practices. The initiative aims to fortify mobile applications against common threats like malware and phishing attempts, ultimately safeguarding end-users and their transactions.
The ubiquity of mobile app usage, highlighted by the CSA’s 2022 Cybersecurity Awareness Survey, underscores the need for enhanced security measures. The survey revealed that over eight in 10 respondents installed utility applications, including those for banking, e-commerce, and transportation, on their mobile devices. With this pervasive mobile app adoption, users become vulnerable to potential risks such as monetary loss and unauthorised access to confidential data.
The “Safe App Standard” provides a dynamic framework that will evolve alongside the ever-changing risk landscape. The initial version, unveiled focuses on applications facilitating high-risk transactions. These transactions, defined as those enabling some or full access to users’ financial accounts pose significant threats, with potential consequences ranging from unauthorised changes to financial functions to an increase in fund transfer limits.
Acknowledging the pivotal role of authentication in mobile applications, the standard emphasises securing authentication mechanisms, including biometrics, personal identification numbers, or multi-factor authentication codes. Adhering to industry best practices is crucial to validate user identity and ensure legitimate access.
Working hand-in-hand with authentication, authorisation security plays a vital role in determining access rights within an app. The standard advocates for systematic controls to validate user access rights, bolstering the overall defence against unauthorised access.
Ensuring the integrity and confidentiality of sensitive data during periods of inactivity or when not actively transmitted is crucial. The standard emphasises safeguarding personally identifiable information stored locally on users’ devices and application servers.
Implementing anti-tampering and anti-reversing security controls acts as an additional layer of defence. These measures, including anti-malware detection and anti-keystroke capturing, make it more challenging for malicious actors to compromise applications.
The “Safe App Standard” draws inspiration from established industry benchmarks, including the Open Web Application Security Project, the Payment Card Industry Data Security Standard, and the European Union Agency for Network and Information Security.
The finalisation of the standard followed extensive consultations with various stakeholders, including government agencies, financial institutions, e-commerce entities, consultancy firms, and technology companies.
Local app developers and providers are strongly encouraged to adopt the CSA’s recommended standard in their development processes. By embracing this standard, developers can ensure the security of their applications, providing users with a robust defence against potential threats. This proactive approach aligns with the broader goal of creating a secure online environment and fostering more confidence in digital transactions for the public.
Besides, OpenGov Asia earlier reported that CSA is proactively addressing the evolving cybersecurity landscape by initiating a public consultation on the proposed Cybersecurity (Amendment) Bill. The amendment aims to update Singapore’s cybersecurity laws in response to technological shifts, extending oversight to critical information infrastructure, nationally important computer systems, and entities of special cybersecurity interest.
The bill seeks to enhance regulations, ensuring the Commissioner of Cybersecurity has greater situational awareness for timely responses. This multifaceted approach involves mandatory adherence to cybersecurity standards, incident reporting, and compliance with directives, fostering a comprehensive strategy. Public input is crucial for inclusivity, transparency, and refining legislation to anticipate emerging cyber threats, reinforcing Singapore’s commitment to cybersecurity leadership.
