MAS-L1 - Essential Security
How to proceed when no MASTG TEST exists
The MASTG does not yet provide dedicated tests for every MASWE. Defining a weakness and defining a reliable, reproducible way to test for it are different tasks, and some areas require extensive research, validation, or refinement before they can be captured as formal MASTG TESTs. The guide also evolves continuously as platforms, frameworks, and testing techniques change.
Even when no dedicated MASTG TEST exists, you can still assess the weakness.
-
Start with the MASWE: Review its "Modes of Introduction" to understand the concrete conditions that may introduce the weakness and what should be tested.
-
Check related MASTG content: Look at similar or related existing MASTG TESTs, as they can provide useful testing patterns, structure, and inspiration for designing a new test. Also consult relevant MASTG KNOW, TECH, and TOOL entries, together with the official mobile platform documentation, to understand the topic and identify suitable testing techniques.
-
Contribute back: If you develop a reliable testing procedure, consider contributing a new MASTG TEST and a MASTG DEMO so others can reuse it.
MAS-L1 provides a baseline for the most fundamental security requirements and best practices that every mobile app should meet to protect against common threats.
This profile emphasizes adhering to secure defaults provided by the OS and frameworks and implementing well-recognized security measures considered 'essential'. These include, for example, using TLS or up-to-date strong cryptography. Certain tests are included due to their minimal implementation effort relative to their significant security enhancement.
It assumes that:
- the security controls of the mobile operating system can be trusted (e.g. the device is not rooted/jailbroken).
- the primary user of the device is not viewed as an adversary.
- other applications installed on the device are viewed as an adversary.
MAS-L1 is recommended for
- all mobile apps as a baseline
- apps that only deal with (user) low-risk sensitive data and do not contain sensitive functionality.
Requirements¶
| Requirement | MASWE ID | Platform | MASVS ID | Tests | Status |
|---|---|---|---|---|---|
| The app encrypts sensitive data stored outside of private storage. | MASWE-0002: Sensitive Data Stored Unencrypted Outside of Private Storage | MASVS-STORAGE-1 | 4 | ||
| The app stores cryptographic keys inside the platform-provided secure keystore. | MASWE-0003: Cryptographic Keys Stored Outside of Platform Keystore | MASVS-STORAGE-1 | 3 | ||
| The app does not hardcode sensitive data in the application package. | MASWE-0004: Sensitive Data Hardcoded in the App Package | MASVS-STORAGE-1 | 0 | ||
| The app excludes sensitive data from application logs. | MASWE-0005: Insertion of Sensitive Data into Logs | MASVS-STORAGE-2 | 4 | ||
| The app excludes sensitive data from backups. | MASWE-0006: Sensitive Data Not Excluded From Backup | MASVS-STORAGE-2 | 4 | ||
| The app properly encrypts sensitive data. | MASWE-0007: Improper Encryption | MASVS-CRYPTO-1 | 10 | ||
| The app properly hashes sensitive data. | MASWE-0008: Improper Hashing | MASVS-CRYPTO-1 | 1 | ||
| The app properly uses Message Authentication Codes (MACs). | MASWE-0009: Improper Use of Message Authentication Code (MAC) | MASVS-CRYPTO-1 | 0 | ||
| The app properly generates cryptographic signatures. | MASWE-0010: Improper Generation of Cryptographic Signatures | MASVS-CRYPTO-1 | 0 | ||
| The app properly verifies cryptographic signatures. | MASWE-0011: Improper Verification of Cryptographic Signature | MASVS-CRYPTO-1 | 0 | ||
| The app properly generates random numbers. | MASWE-0012: Improper Random Number Generation | MASVS-CRYPTO-1 | 4 | ||
| The app securely generates cryptographic keys. | MASWE-0013: Improper Cryptographic Key Generation | MASVS-CRYPTO-2 | 2 | ||
| The app derives cryptographic keys using approved key derivation functions. | MASWE-0014: Improper Cryptographic Key Derivation | MASVS-CRYPTO-2 | 0 | ||
| The app enforces authentication and authorization on its components. | MASWE-0018: Lack of Authentication or Authorization on App Components | MASVS-AUTH-1 | 6 | ||
| The app enables auto-fill support for credential providers. | MASWE-0019: Lack of Auto-fill Support for Credential Providers | MASVS-AUTH-1 | 0 | ||
| The app encrypts all network traffic. | MASWE-0026: Network Traffic Not Encrypted | MASVS-NETWORK-1 | 16 | ||
| The app validates certificates for all network traffic. | MASWE-0027: Insecure Certificate Validation | MASVS-NETWORK-1 | 9 | ||
| The app securely handles deep links. | MASWE-0029: Insecure Deep Links | MASVS-PLATFORM-1 | 5 | ||
| The app uses the clipboard securely and only with user consent. | MASWE-0030: Improper Use of the Clipboard | MASVS-PLATFORM-1 | 0 | ||
| The app only permits trusted app extensions to interact with it. | MASWE-0031: Allowing Untrusted App Extensions | MASVS-PLATFORM-1 | 1 | ||
| The app securely handles intents. | MASWE-0032: Insecure Intents | MASVS-PLATFORM-1 | 3 | ||
| The app does not expose sensitive native functionality to WebView content. | MASWE-0033: Sensitive Native Functionality Exposed in WebViews | MASVS-PLATFORM-2 | 0 | ||
| The app only allows trusted WebView content to access local resources. | MASWE-0034: WebViews Allow Access to Local Resources with Untrusted Content | MASVS-PLATFORM-2 | 13 | ||
| The app only allows trusted content in WebViews. | MASWE-0035: WebViews Loading Untrusted Content | MASVS-PLATFORM-2 | 5 | ||
| The app targets the latest platform version. | MASWE-0042: Latest Platform Version Not Targeted | MASVS-CODE-1 | 0 | ||
| The app's third-party components are regularly checked for known vulnerabilities. | MASWE-0044: Dependencies with Known Vulnerabilities | MASVS-CODE-3 | 4 | ||
| The app uses standard APIs for security-critical functionality. | MASWE-0047: Using Non-Standard APIs for Security-Critical Functionality | MASVS-CODE-3 | 0 | ||
| The app package does not contain malicious code. | MASWE-0048: Malicious Code Included in the App | MASVS-CODE-3 | 0 | ||
| The app securely handles untrusted data. | MASWE-0050: Unsafe Handling of Untrusted Data | MASVS-CODE-4 | 4 |