Source hierarchy
Standards and regulators
Normative or authoritative text for requirements, scope, and official terminology.
Platform owners
Current technical behavior for Android, Google Play, iOS, and Apple security services.
Primary tools and projects
Original documentation for testing methods and instrumentation capabilities.
Commercial perspective
Vendor material for delivery models and product viewpoints, never treated as independent proof.
Reference library
- AICPA & CIMA
System and Organization Controls: SOC Suite of Services
Authoritative overview of SOC assurance services and system-level controls.
aicpa-soc android-signing- Android Developers
Code transparency for Android App Bundles
Developer-verifiable transparency for DEX and native libraries in delivered APKs.
android-code-transparency - Android Developers
Show a biometric authentication dialog
Platform biometric authentication and cryptographic binding patterns.
android-biometric - Apple Developer
Establishing your app’s integrity
App Attest enrollment and assertion flow for server-side verification of genuine app instances.
apple-app-attest apple-devicecheck- Apple Developer
Preventing insecure network connections
App Transport Security and secure trust configuration.
apple-ats - Apple Platform Security
App code signing process
Mandatory code signing and dynamic-library validation on Apple mobile platforms.
apple-code-signing - Apple Platform Security
Security of runtime process in iOS, iPadOS and visionOS
Sandboxing, entitlements, ASLR, and execute-never protections.
apple-runtime - Apple Platform Security
Keychain data protection
Keychain encryption, Secure Enclave interaction, and data-protection classes.
apple-keychain - Apple Platform Security
The Secure Enclave
Hardware-isolated key protection and cryptographic services.
apple-secure-enclave approov-attestation- EUR-Lex
Commission Delegated Regulation (EU) 2018/389 on strong customer authentication
Official regulatory technical standards for strong customer authentication and secure communication under PSD2.
eu-psd2-sca - EUR-Lex
Regulation (EU) 2022/2554 — Digital Operational Resilience Act
Official text of the EU framework for ICT risk management, incident handling, resilience testing, and third-party risk in financial entities.
eu-dora - EUR-Lex
Regulation (EU) 2016/679 — General Data Protection Regulation
Official GDPR text governing lawful, transparent, purpose-limited, and secure processing of personal data.
eu-gdpr - Frida
Frida documentation
Primary documentation for the dynamic instrumentation toolkit used in legitimate testing and by attackers.
frida-docs - Google for Developers
Play Integrity API
Server-verifiable app and device integrity verdicts for important Android actions.
android-play-integrity - Google for Developers
Play Integrity API overview
Verdicts, request flows, replay protection, and response strategy.
android-integrity-overview - Google for Developers
Android Security Checklist
Platform security fundamentals covering integrity, storage, permissions, networking, and authentication.
android-security - Google for Developers
Android Keystore system
Non-exportable keys, hardware-backed protection, and key-use restrictions.
android-keystore - Google for Developers
Network Security Configuration
Declarative trust anchors, cleartext policy, debug overrides, and certificate pinning.
android-network - Google Search Central
SEO Starter Guide
Search-friendly structure, useful content, metadata, links, and anti-spam guidance.
google-seo - Google Search Central
Creating helpful, reliable, people-first content
Quality and trust guidance used for this knowledge center's editorial policy.
google-helpful - Guardsquare
Runtime Application Self-Protection (RASP)
Commercial implementation perspective covering runtime detection and response on Android and iOS.
guardsquare-rasp - International Organization for Standardization
ISO/IEC 27001:2022 — Information security management systems
Official overview of the requirements standard for establishing and continually improving an information security management system.
iso-27001 - MITRE
MITRE ATT&CK Mobile Matrix
Observed adversary tactics and techniques affecting Android and iOS.
mitre-mobile - National Institute of Standards and Technology
NIST SP 800-218: Secure Software Development Framework
Risk-based secure development practices across preparation, protection, production, and response.
nist-ssdf - OWASP Foundation
OWASP MASTG: Runtime Application Self-Protection (RASP)
Definition, core capabilities, implementation approaches, and explicit limitations of Mobile RASP.
owasp-rasp - OWASP Foundation
OWASP MASVS-RESILIENCE
The resilience control group for reverse engineering and tampering resistance.
owasp-resilience - OWASP Foundation
OWASP Mobile Application Security Testing Guide
Testing methodology, techniques, tools, and reproducible mobile security test cases.
owasp-testing - OWASP Foundation
OWASP MASTG: Implementing Resilience and RASP Signals
Practical guidance for distributing, combining, and handling runtime resilience signals.
owasp-rasp-signals - OWASP Foundation
OWASP MASTG: Hardening Against Runtime Hooking
Defense-in-depth guidance for runtime method and function hooking.
owasp-hooking - OWASP Foundation
OWASP MASTG: Continuous Anti-Debugging Checks
Guidance for recurring anti-debugging checks rather than one startup gate.
owasp-antidebug - OWASP Foundation
OWASP MASTG: Root Detection
Android root indicators, constraints, and testing considerations.
owasp-root - OWASP Foundation
OWASP MASTG: Jailbreak Detection
iOS jailbreak indicators, limits, and resilience considerations.
owasp-jailbreak - OWASP Foundation
OWASP MASTG: Runtime Integrity Verification
Runtime code and control-flow integrity concepts for Android applications.
owasp-integrity - OWASP Foundation
OWASP MASTG: Emulator Detection
Signals and limitations associated with detecting emulated environments.
owasp-emulator - OWASP Foundation
OWASP MASTG: Obfuscation
Code obfuscation concepts and their place in a layered resilience strategy.
owasp-obfuscation - PCI Security Standards Council
Mobile Payments on COTS (MPoC)
The modular security standard for payment acceptance on commercial mobile devices.
pci-mpoc - PCI Security Standards Council
Software-based PIN Entry on COTS (SPoC)
Security requirements for software PIN entry on commercial mobile devices.
pci-spoc - U.S. Department of Health and Human Services
The HIPAA Security Rule
Official overview of administrative, physical, and technical safeguards for electronic protected health information.
hhs-hipaa-security
How citations are used
Each guide lists the sources directly relevant to its claims. Mobile RASP paraphrases rather than reproduces source text, identifies analysis and limitations, and links readers to the originating publisher so scope and updates can be checked.