4

I am developing an Android app that will potentially handle sensitive user data, and some of it may be even considered medical data (for example user height, weight, alergies, etc).

What would be the recommended security practices to protect the user's data both from the client-side perspective as well as the server-side?

I'm not talking about practices needed to get government certifications, but just strong, tested and recommended practices for good user info protection.

For example, on the client side, encrypting the database (with SQLCipher maybe?) at all times, and just decrypt the info when needed. If any of this information is to leave the device, then SSL would be a must. Never store a user's password. Authentication session handling, etc. Caching issues, should I cache frequently-accessed or decrypt it from db everytime it's needed?

On the server side, hashing and salting the passwords instead of storing plain-text passwords is also industry-standard.

Bonus points for references or explanations on how to correctly implement said practices.

Clarification: I'm not stating that the aforementioned example practices are indeed good practices, it's just to illustrate the kind of general practices I'm talking about.

Improve this question

1 Answer 1

Reset to default
3

Before I answer this I have to say something.

Security is one facet of development you can't just "wing", especially if you're dealing with sensitive user medical data. While the attributes you have listed probably don't fall under HIPPA, if you make certain guarantees to users and the data gets compromised you may be in potential legal trouble. If your security fails, it's not something you can just patch and make it all better; your users will lose confidence, and your reputation will suffer.

If this is a serious application that you're planning to make money on, then invest in it properly and hire someone who knows security to consult or help in the design/test process. If it's just a fun side project and you feel like you "should have some security", I recommend you re-evaluate what you're planning.

To actually answer your question I would start by pointing you to OWASPs Mobile Security Project for Android. This should give you enough information to read to explain the most common pitfalls. For more formal resources O'reilly almost always has a book on whatever subject you're on. Take a look at [Application Security for the Android Platform].2

Good luck.

Improve this answer
2
  • Great advice. Thanks!. Now for a follow-up question. Right now let's say ther are only two of us, so while I would like to think that I'll make money at some point I can't hire someone for that particular part right now. What I would like to do is have a reasonable idea on what to expect I will need in the future, to properly secure the information. Also, assuming I do have the money to hire someone for this, where would the best place be to find someone with the proper credentials? I guess it's really hard to distinguish a professional from a snake-oil salesman.
    – Acapulco
    Feb 7, 2014 at 15:57
  • 1
    I would suggest including a security professional in the design phase and after development for validation. They will be able to look at your specific situation and tell what your security needs will be. You cant protect against everything in security, so you will need to find the optimal balance between protection, development time, and cost (implementation and validation). For validation have a separate person validate (pentest). Finding a reputable person may be hard but I haven't worked from that side. That may be another great question to submit by itself.
    – Daisetsu
    Feb 7, 2014 at 16:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .