Testing and securing android studio applications: Debug and secure your Android applications with Android Studio

Access control: This ensures selective access to resources by users that are entitled to it.

Asymmetric cryptography: This is also known as the public key cryptography and uses algorithms that employ a pair of keys—one public and one private. A public key is used to encrypt the data while a private key is used to decrypt data.

Authentication: This is a process through which we can confirm the identity of a user.

Authorization: This is a process through which we give someone permission to do or have something.

Availability: This means that the system and data are available to authorized users when they may make use of it.

Brute force: This is a very basic and nonoptimal cryptanalysis technique that tries every possibility to crack a key or a password.

Cipher: This is a cryptographic algorithm that may be used for encryption and decryption.

Code injection: This is an attack where the code is inserted into application queries. This kind of attack is commonly used to alter databases via SQL injections.

Confidentiality: This specifies that the data is only available for users who have permission to access it.

Crack: This is the process through which an attacker attempts to gain access to a machine, network, or software.

Decryption: This is the process through which an encrypted message is transformed into its original state.

Denial-of-service (DoS): This is a type of attack that makes an online resource unavailable for a fixed amount of time.

Distributed denial-of-service (DDoS): This type of attack is similar to the DoS attack, but it is perpetrated from several machines and is generally more effective than a DoS attack.

Dictionary attack: This is a basic cryptanalysis technique that uses all the words in a dictionary when trying to crack a key or password.

Encryption: This is a process through which a plain piece of data is transformed into an encrypted state, with the objective of concealing this information in order to prevent access from unwanted sources.

Hash function: This is a type of algorithm that maps data of different sizes into data of a fixed size.

Hijack attack: This is a form of attack in which an already established communication is seized and acts as one of the original participants.

Hypertext Transfer Protocol Secure (HTTPS): This is an application level protocol based on HTTP that allows a secure transfer of sensitive information in the form of hypertext.

Integrity: This means that the information is accurate and is not changed accidentally or deliberately.

MD5: This is a very commonly used hash function.

Man-in-the-middle attack: This is a type of attack where the attacker assumes a position in the middle of a communication, intercepts and reads the messages of a communication, and lets the victims believe that they are directly connected to each other.

Password: This is a string of characters used for authentication.

Phishing: This is an attack attempt that appears to be from a reliable source and tricks the user into entering their authentication credentials in a different domain or application.

Risk: This is the likelihood of an attack happening and succeeding.

SHA1: This is a commonly used hash function.

Sniffing attack: This is an attack that analyses the packets exchanged in a network in order to extract useful information from them.

Spoofing attack: This is an attack where an unauthorized entity gains access to a system with the credentials of an authorized user.

Symmetric cryptography: This is a type of cryptography that uses the same key for encryption and decryption, and therefore, every entity shares the same key.

Threat: This is a circumstance that could breach security and cause harm to the system.

Vulnerability: This is a weakness that allows for a threat to occur.

Secure defaults: Security is of the utmost importance for an average user. When designing your application, you should make sure that the most demanding user is going to be satisfied and, therefore, your application should offer the best security methods available. However, there are some users who may prefer accessibility over security and may want to reduce the level of security. For example, you may want to add password aging to your authentication system. This means that every established period of time, the users should change their password to a new one. This means an additional level of security but can be annoying for certain users. Adding an option in the preferences to turn off this feature can be a good idea. However, always make sure to set the default to the more secure setting, and let the user decide whether they want to increase the risk of breaching their information.

Least privileges: Privileges are sometimes conceded in excess in order to speed up the process of development. This principle states that you should always concede the least privileges as possible in order to minimize security risks.

Clarity: Never trust obscurity to ensure the security of your application. Concealing the information on how your security system works is a good idea, but it should not be granted as enough by itself; the security must come from good cryptographic techniques and a good security design.

Small surface area: If you know you may have vulnerability in a determined section of your code, you can try to minimize the risk of a threat exploiting it by minimizing the overall use of this section. For example, if you think that certain functionality may be exploited, you can restrict this functionality to authenticated users.

Strong defense: When defending against a certain attack, there may be different methods to use. One control can surely be enough but sensitive information demands extraordinary measures. Also, using more than one method of precaution is most of the times convenient.

Failing securely: When developing our application, we aim for the highest robustness. However, applications fail sometimes and we need to adapt our code to make sure the application fails securely. When programming for Android, we can address this issue by controlling every exception, for example, through the correct usage of try and catch.

Not trusting the third-party companies: There are many services available that have been developed by the third-party companies with different privacy and security policies. It is important to know that while using one of these services, you trust the companies on how they use your information. The principle of not trusting the third-party companies recommends that you should only trust an external service with the minimal amount of information possible and always implies a certain level of trust with them.

Simplicity: Always try to keep your security code simple. Although it is recommended to use code patterns, when talking about security, the safest and more robust way is its simplicity.

Address vulnerabilities: When you detect vulnerability, it is important to address this issue correctly. You need to understand both the vulnerability and the threat and then act accordingly.

Control flow testing: This evaluates the flow graph of the software to indicate whether the set of tests covers every possible test case.

Data flow testing: This requires an evaluation of how the program variables are used.

Basis path testing: This ensures that every possible path in a code has been included in the test cases.

Statement coverage: This consists of the evaluation of the code and the development of individual tests that will work on every individual line of code.

Equivalence partitioning: This divides test cases in different partitions that present similar characteristics. This technique can help in reducing the number of tests cases.

Boundary value analysis: This is performed in order to analyze the behavior of a component when the input is near the extreme valid values.

Cause-effect graphing: This graphically illustrates the relationship between circumstances or events that cause a determined effect on the system.

State transition testing: This is performed through a number of inputs that make the system execute valid or invalid state transitions.

All pairs testing: This is a combinatorial method that tests every possible combination of parameters. When the number of parameters and the possible values for each parameter are big, this test technique can be combined with the equivalent partitioning technique to reduce the number of test cases.

Syntax testing: This analyses the specifications of a component to evaluate its behavior with a huge number of different inputs. This process is usually automatized due to the large number of inputs required.

Unit tests: These tests focus on each individual component. These tests are usually performed by the same development team and consist of a series of tests that evaluate the behavior of a single component checking for the correctness of the data and its integrity.

Integration tests: These tests are performed by the development team. These tests assess the communication between different components.

Validation tests: These tests are performed by the fully developed software in order to evaluate the fulfilment of functional and performance requirements. They can also be used to assess how easy it is to maintain or to see how the software manages errors.

System tests: These tests involve the whole system. Once the software is validated, it is integrated in the system.

Acceptance tests: These tests are performed in the real environment where the software is used. The user performs these tests and accepts the final product.