1. GOOGLE
1.1. Core app quality
1.1.1. SC-DF3
1.2. App Security Best Practices
1.2.1. Enforce secure communication Use WebView objects carefully
2. National Information Assurance Partnership (NIAP)
2.1. Requirements for Vetting Mobile Apps from the Protection Profile for Application Software
2.1.1. Access to Platform Resources FDP_DEC_EXT.1.1
2.1.2. Supported Configuration Mechanism FMT_MEC_EXT.1.1
2.1.3. Anti-Exploitation Capabilities FPT_AEX_EXT.1.1
2.1.4. Anti-Exploitation Capabilities FPT_AEX_EXT.1.4
2.1.5. Integrity for Installation and Update FPT_TUD_EXT.1.2
2.1.6. Use of Third Party Libraries FPT_LIB_EXT.1.1
3. US National Institute of Standards and Technology (NIST)
3.1. NIST Special Publication 800-190
3.1.1. 4.1.2 Image configuration defects
3.1.2. 4.1.5 Use of untrusted images
3.1.3. 4.2.2 Stale images in registries
3.1.4. 4.3.1 Unbounded administrative access
3.1.5. 4.3.4 Mixing of workload sensitivity levels
3.1.6. 4.4.3 Insecure container runtime configurations
3.1.7. 4.5.1 Large attack surface
3.1.8. 4.5.2 Shared kernel
3.1.9. 6.3 Implementation Phase
4. UK National Cyber Security Centre (NCSC)
4.1. Application development Recommendations
4.1.1. Third party applications
4.1.2. 3.2 In-house applications SECURITY CONSIDERATIONS
4.1.3. Secure iOS application development 1.3 Secure application development recommendations Pasteboard and debugging data
4.1.4. Secure deployment of iOS applications 3.2 In-house applications Security considerations
4.1.5. Secure deployment of Windows application 3.2 In-house Windows store applications
4.1.6. Secure deployment of Windows application 3.3 General security advice Unmanaged deployment
5. Open Web Application Security Project (OWASP)
5.1. Mobile Application Security Verification Standard (MASVS)
5.1.1. 2.8 MSTG-STORAGE-8
5.1.2. 2.9 MSTG-STORAGE-9
5.1.3. 2.10 MSTG-STORAGE-10
5.1.4. 6.5 MSTG-PLATFORM-5
5.1.5. 6.6 MSTG-PLATFORM-6
5.1.6. 7.3 MSTG-CODE-3
5.1.7. 8.1 MSTG-RESILIENCE-1
5.1.8. 8.11 MSTG-RESILIENCE-11
5.1.9. 8.12 MSTG-RESILIENCE-12
5.2. Application Security Verification Standard 4.0.3 (ASVS)
5.2.1. V1.2 Authentication Architecture
5.2.2. V1.6 Cryptographic Architecture
5.2.3. V1.14 Configuration Architecture
5.2.4. V4.1 General Access Control Design
5.2.5. V4.3 Other Access Control Considerations
5.2.6. V7.1 Log Content
5.2.7. V7.2 Log Processing
5.2.8. V7.3 Log Protection
5.2.9. V8.1 General Data Protection
5.2.10. V10.2 Malicious Code Search
5.2.11. V14.1 Build and Deploy
5.2.12. V14.2 Dependency
6. MITRE
6.1. Application Developer Guidance
6.1.1. T1574 Hijack Execution Flow
6.1.2. T1574.002 DLL Side-Loading
6.1.3. T1559 Inter-Process Communication
6.1.4. T1559.003 XPC Services
6.1.5. T1647 Plist File Modification
6.1.6. T1513 Screen Capture
7. ioXt Alliance
7.1. Mobile Application Profile
7.1.1. 4.4. No Universal Password UP106
7.1.2. 4.5. Verified Software VS4
7.1.3. 4.6. Security by Default SD111
7.1.4. 4.7. Secured Interfaces SI1.1
7.1.5. 4.7. Secured Interfaces SI1.2
7.1.6. 4.7. Secured Interfaces SI1.3
7.1.7. 4.7. Secured Interfaces SI1.4
7.1.8. 4.7. Secured Interfaces SI2.1
7.1.9. 4.7. Secured Interfaces SI2.2
7.1.10. 4.7. Secured Interfaces SI2.3
7.1.11. 4.7. Secured Interfaces SI102
7.1.12. 4.7. Secured Interfaces SI103