Security Glossary

A dashboard is a visual interface that displays key metrics, data insights, and system status in an organised and centralised view. Dashboards provide visibility into security events, threats, and system performance, enabling faster decision-making and incident response. A dashboard collects data from different sources like logs, monitoring tools, and analytics systems, and presents it through charts, alerts, and summaries. In mobile app security, dashboards help track runtime threats, user activity, and attack patterns, allowing teams to monitor the app’s security posture in real time.

Dynamic Application Security Testing (DAST) is a security testing method that examines running applications (typically web or mobile apps) to find runtime vulnerabilities. For mobile apps, DAST helps detect real-world attack scenarios like API manipulation or Man-in-the-Middle (MitM) attacks. It interacts with the executing application. For example, it may test how a login system behaves under malicious input. Bugsmirror RunLock is an advanced DAST tool that detects more than 50 runtime threats within 24 hours. It analyses by simulating how an app actually executes, providing a more complete security picture. The testing is done in a real device to ensure zero false positives. RunLock provides proof-of-concept and reproduction steps for findings, helping developers fix issues before attackers exploit them in production.

Data anonymisation is the process of removing or modifying personal or identifiable information, such as names, addresses, or ID numbers, within datasets so that individuals cannot be identified. It is necessary to protect user privacy and reduce the risk of sensitive data exposure in case of a breach. This is performed by techniques such as masking, tokenisation, and data generalisation to ensure that data cannot be linked back to an individual. In mobile apps, anonymisation is used when handling analytics, logs, or shared datasets to ensure user privacy while still enabling data analysis.

A data breach is an incident where sensitive information (personal data, credentials, financial records, etc.) is exposed or accessed by unauthorised parties. This happens when attackers exploit security flaws (e.g. software bugs, misconfigurations) to steal or leak data. Storing passwords in plain text could lead to credentials theft. Common causes include weak passwords, unpatched software, and phishing or insider threats. Data breaches cause financial loss, legal penalties, and loss of customer trust. After a breach, companies investigate the incident, fix vulnerabilities, and may provide credit or privacy measures for victims. Organisations usually must notify affected individuals and regulators.

Data classification is the process of categorising data based on its sensitivity and importance to an organisation. It helps apply appropriate security controls to different types of data, reducing the risk of unauthorised access or data leaks. Data is labelled into categories such as public, internal, confidential, or restricted, based on its sensitivity and usage. In mobile applications, data classification ensures that sensitive information, such as personal data and financial details, receives stronger protection compared to less critical data.

Data encryption converts readable data into an unreadable format to protect it from unauthorised people. It ensures that data is confidential and protects sensitive information from interception or theft. Encryption uses cryptographic algorithms and keys to encode data, which can only be decrypted by people with a decryption key. In mobile apps, sensitive data should never be left unencrypted to protect it. Encryption protects user data stored on devices and transmitted to the backend server for secure communication and data storage.

Decryption is a process of converting encrypted or unreadable data back into its original plaintext using a specific key or password. It is the opposite of encryption, which secures data, ensuring it can be opened using a specific key or by authorised people. There are two mechanisms of performing decryption:

• Symmetric key, in which the same key is used to encrypt and decrypt data.
• In standard asymmetric cryptography:
• Public key → encrypt.
• Private key → decrypt.

In this process, the system receives the encrypted ciphertext, obtains the specific key, and the algorithm processes the ciphertext with the key, giving an output of plain text. It is an important process to secure sensitive data and for secure communication.

DevSecOps (Development, Security, and Operations) is a methodology and approach for implementing security into every stage of the software development lifecycle (SDLC), rather than thinking of it as an afterthought. Key characteristics of DevSecOps:

• Shift Left Security: Integrating SAST and DAST into coding and building phases.
• Automation: Integrating security tools into CI/CD pipelines for automated scans for threats.
• Security by Design: Introduce security from ideation and product design phase.
• Shared Responsibility: Shared responsibility across development, security, and operations teams.
• Key components: It includes container security, compliance monitoring, and Infrastructure as Code (IaC). The main aim of DevSecOps is to develop secure applications to reduce cyberattacks, identify vulnerabilities in early stages and simplify roles.