Mobile App Security Engineering

Your mobile app may look great, run smoothly, and have thousands of downloads. But underneath that polished interface, attackers may be looking for one thing: a way in.

And unfortunately, "we'll worry about security later" is not a security strategy.

In Mobile App Security Engineering, Drevar Solis takes you inside the world of mobile application security and shows you how to think like a security engineer before attackers do. With a practical, approachable, and occasionally humorous style, this book explores how to protect mobile applications from reverse engineering, data theft, tampering, credential attacks, API abuse, and other real-world threats.

Whether you are a mobile developer, security engineer, software architect, penetration tester, DevSecOps professional, or technology leader, this book provides a structured foundation for building more resilient mobile applications.

You'll explore:

• The modern mobile application threat landscape and how attackers identify weaknesses
• Mobile app architecture and the most important attack surfaces to secure
• Secure coding practices, input validation, authentication, authorization, and dependency management
• Strong authentication, OAuth, OpenID Connect, tokens, sessions, and account takeover prevention
• Encryption, secure local storage, cryptographic keys, and protection against data leakage
• Mobile API security, abuse prevention, rate limiting, and secure client-server communication
• Reverse engineering, static analysis, dynamic analysis, application tampering, and repackaging
• Code obfuscation, anti-tampering techniques, runtime application protection, and attack detection
• Root and jailbreak detection, debugger detection, emulator awareness, hooking, and code injection defenses
• Android and iOS security architectures, permissions, application communication, and platform security
• Mobile application security testing, vulnerability assessment, penetration testing, and threat modeling
• Security monitoring, incident response, vulnerability disclosure, CI/CD security, and continuous protection