Standardizing Mobile Defense: Inside the OWASP Mobile App Security Project v2 - ASW #405

The OWAS Mobile Application Security (MAS) project recently released an updated version of its guidance, with excellent advice organized into common weaknesses, a verification standard for devs (MASVS), and a testing guide (MASTG). Ryan Lloyd and Jan Seredynski from Guardsquare dive into the project to talk about how it's been updated, how orgs can use it, and the challenges orgs face in managing their mobile frameworks and environments. We also cover how agents and LLMs are impacting mobile security and what future iterations of the MAS project might include for securing mobile apps interacting with LLMs or being written by LLMs. Finally, we share practical ways for developers to get involved as OWASP contributors and advocates. Segment Resources: https://mas.owasp.org https://mas.owasp.org/MASWE/ https://hubs.ly/Q04ykvgm0 This segment is sponsored by Guardsquare. Visit https://securityweekly.com/guardsquare to learn more! Visit https://www.securityweekly.com/asw for all the latest episodes! Show Notes: https://securityweekly.com/asw-405 0:00 Introduction to OWASP project 2:27 Why the top 10 list was removed 5:08 Mobile app security weaknesses 8:33 Storage and platform security 14:04 Security profiles and testing 18:52 LLMs in mobile security 23:26 Shifting to native development 27:32 Adopting verification standards 33:27 External standards and presets 37:03 Platform and ecosystem challenges 42:43 Future of mobile security 47:39 Contribution and closing remarks