Ship It Conversations: Guardsquare’s Joel DeStefano on Mobile App Security, Runtime Protection, App Hardening, and Why Scanning Isn’t Enough
<p>This is a guest conversation episode of <strong>Ship It Weekly</strong>, separate from the weekly news recaps.</p><p>In this Ship It: Conversations episode, I talk with Joel DeStefano from Guardsquare about mobile app security, why it is different from backend and cloud security, and why scanning alone is not enough once an app is shipped into the real world.</p><p>We talk about the shift in trust model that happens with mobile apps. In backend and cloud systems, teams usually have more control over the runtime, infrastructure, policies, and monitoring. With mobile, the app becomes a public artifact running on someone else’s device, in an environment you do not fully control.</p><p>The bigger theme here is that mobile security is not just “scan it before release.” Scanning matters, but teams also need to think about app hardening, obfuscation, runtime protection, monitoring, and whether the app connecting back to their APIs is genuine and uncompromised.</p><p><strong>Highlights</strong></p><p>• Why mobile changes the trust model compared to backend and cloud systems</p><p>• What DevOps, SRE, and platform teams should understand about mobile app risk</p><p>• Why scanning is useful, but not enough by itself</p><p>• The danger of assuming app store approval means an app is secure</p><p>• Why “we do not store sensitive data in the app” can be a misleading security argument</p><p>• How attackers can reverse engineer apps, inspect workflows, and learn how the app talks to backend APIs</p><p>• What code hardening and obfuscation actually help protect against</p><p>• Why runtime checks matter for rooted devices, compromised environments, debuggers, hooking frameworks, overlays, and accessibility abuse</p><p>• The difference between Android and iOS security assumptions</p><p>• Why the OS is not responsible for protecting your app’s business logic</p><p>• How mobile security should fit into CI/CD without destroying release velocity</p><p>• What should block a release versus what should become tracked risk</p><p>• Why testing, hardening, runtime protection, and monitoring should work together as one strategy</p><p>• How AI may speed up attackers without fundamentally changing the need for strong security fundamentals</p><p>• Joel’s advice for improving mobile security posture: start with the app’s critical workflows, backend interactions, and real business risk</p><p><strong>Joel / Guardsquare links</strong></p><p>• Guardsquare: <a target="_blank" rel="noopener noreferrer nofollow" href="https://hubs.ly/Q04fJgkJ0">https://hubs.ly/Q04fJgkJ0</a></p><p>• Guardsquare Blog: <a target="_blank" rel="noopener noreferrer nofollow" href="https://www.guardsquare.com/blog">https://www.guardsquare.com/blog</a></p><p><strong>OWASP mobile security links</strong></p><p>• OWASP Mobile Application Security: <a target="_blank" rel="noopener noreferrer nofollow" href="https://owasp.org/www-project-mobile-app-security/">https://owasp.org/www-project-mobile-app-security/</a></p><p>• OWASP MASVS: <a target="_blank" rel="noopener noreferrer nofollow" href="https://mas.owasp.org/MASVS/">https://mas.owasp.org/MASVS/</a></p><p><strong>Our links</strong></p><p>More episodes + show notes + links: <a target="_blank" rel="noopener noreferrer nofollow" href="https://shipitweekly.fm">https://shipitweekly.fm</a></p><p>On Call Brief: <a target="_blank" rel="noopener noreferrer nofollow" href="https://oncallbrief.com">https://oncallbrief.com</a></p>
