How is the Mobile Application Security Risk Vector Assessed?

Mobile Application Security contributes to how the Diligence risk category is calculated. It evaluates an organization’s mobile application offerings in Android and iOS app stores (assets) to find security risks that can compromise end-users’ devices and networks (findings).

• ⬇️ Criteria
• ⬇️ Methodology
  • ⬇️ Finding Severity
  • ⬇️ App Grade Calculation Based on Security Tests
  • ⬇️ Risk Vector Grade Calculation Based on the Individual App Grade

Application Assessment

Assessment results depending on the action taken during testing.

Result: Pass/Fail

Assessment is immediate. If a new app version is available, the new version replaces all assessments related to the previous one.

If an assessment for a specific version is improved, it also replaces the associated finding.

Insufficient Data

A default risk vector grade is assigned if there is insufficient or no data.

Default:

Behavior: Not all organizations have mobile application offerings. This default grade is assigned if the organization has not published any mobile applications (no assets).

Lifetime

Lifetime is the number of days a finding impacts the risk vector grade, assuming nothing changes in the future and the finding is not updated with new information. This is defined by the number of days a finding will impact the risk vector grade. Learn why findings have a decay and lifetime period.

Duration: 1 year, with no decay period.

Behavior:

Unless updated, all findings have the same impact throughout their lifetime. Their impact is fully removed when updated or after 1 year.

If an app is removed from all app stores or updated to a software version that is not supported (and therefore cannot be scanned), its impact is fully removed.

Weight

The Mobile Application Security risk vector is part of the Diligence risk category, which aggregates the weights of all risk vectors in the category to 70.5% towards Bitsight Security Ratings.

Weight: Not Applicable

Criteria

If a third party developer is involved, please contact Bitsight Support to learn more about Total Risk Monitoring with the Bitsight Security Ratings Platform.

Methodology

Assets are subjected to static and dynamic analysis to evaluate specific types of problems, like how the application handles sensitive data, interaction vulnerabilities, and API security and determine the severity of security vulnerabilities (presented as the findings).

Finding Severity

The evaluation method for tested security vulnerabilities is based on the Common Vulnerability Scoring System (CVSS). The assigned value (of 0.1 to 10.0) is indicative of the severity of each vulnerability.

A number of informational vulnerabilities are also tested. However, these informational vulnerabilities do not negatively impact the rating.

App Grade Calculation Based on Security Tests

Each individual finding in a mobile app is quantified using the Common Vulnerability Scoring System (CVSS). CVSS is a ten-point scale, spanning 0.0 to 10.0 in increments of 0.1. A CVSS value of 0.0 indicates findings that are informational in nature.

The active sum contribution of individual apps is calculated as an app score (α) based on the failure of security tests (τ):

The app grade (γ) is calculated as:

Risk Vector Grade Calculation Based on the Individual App Grade

To calculate the risk vector grade, first, calculate the mean AppGrade (ᾱ) based on the individual AppGrades.

The second step is to calculate a pre risk vector score 𝑥 based on ᾱ using the following formula:

Lastly, the risk vector grade is determined mapping 𝑥 to the grade using the following table: