Collaboration yields automated mobile app software testing

A Department of Homeland Security (DHS) Science and Technology Directorate (S&T) and National Information Assurance Partnership (NIAP) collaboration has resulted in automated mobile application (app) software testing procedures.

Officials said the partnership stems from efforts to ensure the security of mobile app software for use within the federal government, without expending extensive time or funds.

The scope of work involved researchers working with S&T Mobile Security and Emergency Communications (Mobile SEC) partners Kryptowire and Intelligent Waves, officials said, using Kryptowire’s vetting infrastructure to perform an automated analysis of the Android and Apple iOS versions of Intelligent Waves’ Hypori app.

The Leidos Common Criteria Testing Laboratory then analyzed Kryptowire’s results to determine if they were consistent with a conventional evaluation, with officials indicating valuators determined automated testing accurately met NIAP requirements while requiring less time, personnel and money.

“Automated testing will help bring the speed of NIAP evaluations to keep pace with the rapid, agile development and release cycles of today’s modern mobile app ecosystem,” said Mary Baish, director of NIAP, said.

Vincent Sritapan, Mobile SEC program manager, said the pilot’s success is significant in that automating the evaluations to deliver accurate and trustworthy results lowers the barrier to entry by reducing the burden needed for vetting certifications.

“This increased testing will raise the security posture of the government’s mobile app ecosystem and, at the same time, raise confidence among app end-users, primarily the tax-paying public,” he said.