“Business Next Interview” – Be prepared “to be hacked at any time,” App information security pioneer Gamania CloudForce: Impenetrable information security protection is outdated

Many people might still have antivirus software installed on their computers to avoid getting infected by viruses, but not many people have antivirus software installed on their mobile phones.

“Usually when people download Apps, it requires you to grant certain permissions, and many people press OK without even reading what appeared. And this is how backdoor programs might be installed.” That was what the general manager of Gamania CloudForce, Gamania’s subsidiary, Paul Ding said with frustration.

Smartphones have become a necessity of people’s lives, and pure online banking will gradually go online next year, but people’s awareness for the information security of mobile phones has never improved. In response to this, Gamania CloudForce focused on developing information security protection mechanisms for Apps, hoping to add another layer of protection for the rapidly improving mobile phone technologies.

Information security for Apps in Taiwan needs to be strengthened; some developers do not even encrypt their data

The reason why it is difficult to control the information security risks of Apps is not only because people have insufficient awareness on this issue, but also because of two other aspects:  Government policies are not strong enough and that information security protection measures of App developers were not fully implemented.

In Taiwan, the government’s policy for information security risks of mobile apps is mainly based on the “Mobile Application Basic Security Independent Testing Promotion System” implemented by the Industrial Development Bureau since 2015. This regulation evolves every year, but Paul Ding thinks that only until version 3.1 that was just revised and implemented two months ago did this specification become good enough.

“Revision 3.1 referred to foreign standards, such as NIST (National Institute of Standards and Technology) of U.S.A and the rules set by Cloud Security Alliance (CSA); that’s why the information security test standard was increased,” said Paul Ding, “we have encountered many Apps in the past that even though passed earlier certification versions, but were still cracked by us after two hours.”

The information security awareness of developers also needs to be reinforced. Gamania CloudForce discovered that many developers are not quite familiar with individual vulnerabilities of the two major systems Android and iOS, and many of the Apps did not even encrypt the data when it comes to data storage. Paul Ding, who also started from blocking plug-ins for games, also indicated that Apps are similar to games and have shorter life cycles; how developers can fix information security loopholes while updating Apps is also a great challenge.

Because of this, Gamania CloudForce developed two protection mechanisms for the information security of mobile Apps: appGuard and Smart Sensing. Paul Ding refers to appGuard as “an iron suit for information security”; they added a layer of virtual environment outside the App to block attacks from the outside world. Developers can have appGuard installed without having to provide the source code of the App, and so the concern for leaking the source code is also eliminated.

Since no Apps currently on the market have mechanisms to monitor attacks in real-time, Gamania CloudForce also launched the Smart Sensing service to use with the protection function of appGuard; it monitors big data and detects whether the App is being attacked at all times.

Paul Ding stressed that the past concept of wanting to achieve “impenetrable” protection is now outdated. People should hold the idea that their App may be intruded and cracked at any time in order to adjust the design of their information security protection according to the continually evolving attack techniques of hackers. Currently speaking, the App information security in Taiwan is still at the initial stage of development.

Mechanisms for information security control is not complete, online banking requires more preparation

How can the development of information security keep up with the development of new services and technologies? This is an issue that many innovations often face. Paul Ding used online banking as example to share the industry situation he observed

“Many Apps of bank securities were outsourced for development. When you open their Apps, you often realize how similar they look,” said Paul Ding. Gamania CloudForce visited these outsourced developers before and told them that the information security protection of the Apps must be upgraded; but there was no set statement on who is responsible for the protection of information security. Therefore, Paul Ding said it is no secret that information security of online banking still needs more preparations.

Paul Ding looks forward yet is afraid of getting hurt by the coming of open banking, especially when open banking requires the use of large amounts of Open API. He indicated that even though the opening of information can allow banks to have new functions developed by many third parties, how can the quality of these API program developments be controlled? Once the banks open their information and receive the consent of their users to open permission to third parties, who should be held responsible and how should it be handled if information was leaked? These are all problems that future open banking must face.

Next difficulty of the information security industry: The IoT era

As a pioneer of focusing on the information security of mobile Apps in Taiwan’s information security industry, Gamania CloudForce also sees a great challenge for future information security in Taiwan: The coming of the IoT era.

Paul Ding stated that since people have insufficient awareness for the information security of Apps, there are countless numbers of backdoor programs that were installed from downloading Apps. He predicts that in the past, computers were mainly used to launch DDoS attacks, but in the future, they might be launched through mobile phones.

“Once everybody sends a few k of network traffic while the attack is launched, it is even possible to achieve 1.7T attacks. We found it unbelievable to see DDoS attacks that exceeded the T level during earlier times.” He said, average companies could bear such attacks, and with the coming of the IoT era, more equipment might be used to launch DDoS attacks.

Information security of the IoT era will also face new challenges --too many types of IoT equipment; and unlike mobile phones which mainly uses Android and iOS systems, the underlying systems of each IoT equipment company are quite different, just thinking about how to test them requires considering complicated problems such as compatibility etc. IoT also involves relatively closed and traditional industries like the car industry; they are not willing to open their systems to the public, and this increases the difficulty for improving information security protection. “This will be a very complicated market, but will also definitely be a very promising market” said Paul Ding.

Gamania CloudForce is currently gradually developing towards overseas markets and establishing new offices in Hong Kong and Singapore; different services are provided according to their market demands. The financial industry is quite advanced in Hong Kong, so they continued to promote App information security related businesses; but in Southeast Asia, they started with their old profession of providing information security service for games.

Paul Ding also plans to perform mergers and acquisitions overseas, hoping to use the help of local information security companies to allow Gamania CloudForce to expand its layout faster, and enter the market of other South-East Asia countries including Vietnam, Malaysia, and Thailand etc.