backend systems, this one should be worth your time. All right, let's jump in. Today, I'm joined by Joel DeStefano from Guardsquare, where he's a product manager. We're talking about what mobile app security actually means beyond basic scanning, why it's different from backend and cloud security, and how teams can improve posture. Without turning CI/CD into a nightmare. Joel, thank you for joining me. Hey, Brian, thank you. I appreciate being invited onto the show. So I'm curious, why is mobile different from backend and cloud? What changes in the threat model? Fundamentally, it's a shift in the trust model because... On the backend and in cloud, you have relatively good controls over the runtime environment, the servers, the infrastructure, the policies that you put in place. If you look at a mobile application, you ship it. It's a public artifact at that point. You completely lose control over what's happening to that and how is it being used. So once it's out the door, if you don't have reasonable levels of protection into that application, it can be used to read. Attackers can reverse engineer that. You might be installed into an environment on a phone that has malware that is going to scrape that user's information. So there's risks when you ship a mobile application to go. I wouldn't say it goes beyond the backend. It basically essentially opens up a different paradigm of risk and a different trust model. So if you're like a DevOps or SRE person, what's the simplest way to think about it? So there's, I would. Think about it in terms of integrating security into your everyday life, into your build processes. And there's a couple of different facets to that. There's the scanning aspect, which you had mentioned. Scanning is something you would do before you release the application. That's sort of like your background to make sure that. I don't have any vulnerabilities. I understand my third party dependencies. My coding practices, like literally how I code something is not insecure and or improper. So I could maybe have TLS improperly implemented. Well, that's going out the door, right? So that's sort of the, we do this in -house, we do this before release. But then once you release those type of things, those are more point in time type of protections. Now you've done your due diligence on. Prior to release. When it goes

out, you need to still be able to trust that the applications and the users that are connecting to your backend are using a genuine application. It hasn't been compromised. And the integrity of that app and the entire runtime execution is good. That's the only way you could actually sort of protect yourself. You need to be able to trust it. And that's sort of the gap and the challenge with a mobile app opposed to a backend or a cloud service is that. That visibility is lost. It's basically a public artifact at that point. And you really don't know. You don't control that environment. You don't know if it's going to a malware environment. You don't know if it's going to the hands of attackers. You don't know what they're doing with it. That's the real fundamental difference. I would call it a shift in trust. And it's essentially centered around the control. Is there common misconceptions that people have about mobile app security? Does it just kind of encompass what we just talked about or is there? There's a handful of misconceptions. One might be the actual scanning, like that scanning is enough. If I, you know, use proper coding practices and I check all my third-party libraries and there's no vulnerabilities there and I do a lot of dependency tracking, that you're done. Or if you do that in combination with an app store approval process that, okay, we're all set. We really shouldn't need to consider security at that point. That is a... A misconception because of what i just explained um oh yeah i wanted to bring up okay yeah and there's another misconception about what if there's any sensitive information in the actual application i have come across a lot of people who say well we don't have anything sensitive in our app we do all our protections on the backend with our APIs. And that may be true. They may not have a lot of sensitive information. And if they code it right, they don't have a lot of sensitive information. What they don't understand generally is that an attacker doesn't necessarily need to find the same things that you might be worried about or think are a concern. I would say almost any app that has business -critical workflows transactions, logins, dealing with money. I don't really care where the sensitive information is stored. Something can be learned from decompiling that application. And again,