Client-Side Security Is Not Optional: Building with OWASP MASVS

Mobile developers often focus security effort on the backend, treating the client as a trusted extension of the server. In reality, attackers routinely decompile apps, intercept traffic, and manipulate client-side logic to bypass business rules, extract secrets, and compromise user data — all without touching the server at all. This talk introduces the OWASP Mobile Application Security Verification Standard (MASVS) as a practical framework developers can build against from day one, rather than something a pentester checks at the end of the development cycle. Drawing on real-world penetration testing findings, the session walks through the most common client-side weaknesses ;insecure local storage, weak network communication controls, and insufficient resilience against reverse engineering and how MASVS's control groups map directly to fixes developers can implement early. Key Takeaways 1. Understand the difference between MASVS (requirements) and MASTG (testing methodology), and how to use both as a developer, not just as a tester. 2. Learn the most common client-side vulnerabilities found in real mobile pentests and why "the backend validates everything anyway" is a false sense of security. 3. Walk away with a practical, prioritized checklist mapped to MASVS control groups (storage, cryptography, network, platform interaction, resilience) that can be applied to an existing app without a full rebuild. Experience Level with the Topic: I'm a Secure by Design Officer at Safaricom with 7 years of experience across security engineering, systems, and penetration testing spanning AWS, Azure, and endpoint security, with a current focus on offensive security and secure development practices. In my current role, I work closely and continuously with developer teams, embedding security requirements into the SDLC rather than treating security as a final gate before release. This gives me a dual perspective: I understand both how attackers actually interact with mobile apps (through hands-on VAPT work using MobSF, Frida, Objection, jadx, and apktool) and how to translate those findings into requirements developers can realistically act on. My background also includes authorized VAPT engagements for banks, SACCOs, insurance firms, and government targets across Kenya, Uganda, Rwanda, and Tanzania, where MASVS/MASTG form part of the compliance and testing frameworks I apply directly. This talk draws on real patterns observed both in client-facing pentest engagements and in day-to-day work helping internal developer teams build security in from the start. Have you given this talk before? No ; this would be a first-time delivery of this talk. It's a new session built specifically for this conference, based on patterns observed across recent client engagements. Keywords: OWASP MASVS, OWASP MASTG, mobile application security, client-side security, secure mobile development, penetration testing, reverse engineering, mobile app hardening, secure coding, DevSecOps