Back in February, we took a look at the newly-released Safe App Standard published by Singapore’s Cyber Security Agency (CSA), which sought to create a more secure mobile environment for consumers as well as app manufacturers. Fast forward only months later, and the CSA has taken a significant step with the release of Safe App Standard 2.0 (SAS 2.0). 

Signaling a continued emphasis on the push toward fortifying mobile apps, especially those handling sensitive financial transactions, SAS 2.0 stands as a driver for developers to raise the bar when protecting user data and mobile-based activities. 

One of the most significant mandates of SAS 2.0? Anti-tampering and anti-reverse engineering. There’s nothing optional about these security measures in the eyes of the CSA. They’re essential. Without these measures, apps become easy targets for attackers.

SAS 2.0 places notable importance on high-risk apps that handle transactions where mistakes could translate into painful financial losses. These are apps in which users can significantly change financial functions, like adding third-party payees or increasing transfer limits.

SAS 2.0 adds 4 new focus areas

SAS 2.0 expands security measures into 4 new areas: network communication, cryptography, code quality and exploit mitigation, and platform interactions. These are built on previous focuses like authentication, authorization, data storage, and, of course, anti-tampering and anti-reverse engineering.

These 8 total key areas form a structured approach for mobile app developers. They help developers make sure their apps are safe from serious threats like malware, phishing, and data breaches. 

But the most eye-catching part? The overt emphasis was placed on the need for anti-tampering and anti-reverse engineering measures. SAS 2.0 makes it clear: mobile app developers have no choice but to deal with these risks head-on. Anti-tampering and anti-reverse engineering risks are some of the biggest out there, hence the heavy focus within the standard. 

Without proper protections, cybercriminals can easily reverse engineer an app’s code in an effort to reach sensitive data or find vulnerabilities to exploit. Tampering with an app could lead to malicious changes, resulting in users becoming exposed to fraud. 

Related article: Deconstructing a Mobile Banking App Overlay Heist

How SAS 2.0 enhances app security against modern cyberthreats

SAS 2.0 steps in with a clear push: Developers must put in place mechanisms to detect and prevent unauthorized changes to their apps. 

Anti-reverse engineering techniques like code obfuscation and encryption make it more difficult for attackers to understand how the app works. These controls are critical. They prevent data leaks, protect intellectual property, and build trust with users—especially those involved in financial transactions.

SAS 2.0 addresses:

  • Network communication: Data flowing between mobile apps and servers can be intercepted. It’s a known issue. SAS 2.0 mandates the use of secure transmission protocols, ensuring that all data sent is encrypted and only goes to trusted places.
  • Cryptography: Weak cryptographic algorithms are a hacker’s playground. SAS 2.0 insists on using strong cryptographic standards. Digital signatures and well-managed cryptographic keys, for example, keep communications secure.
  • Code quality and exploit mitigation: Using open-source libraries is risky if not tested properly. SAS 2.0 encourages developers to stick to secure coding practices. Update software regularly to reduce the risk of vulnerabilities.
  • Platform interactions: Apps don’t just interact with users; they interact with mobile operating systems. These interactions can be exploited. SAS 2.0 calls on developers to secure things like in-app links. Make sure your app runs on trusted platforms.

With these updates, SAS 2.0 provides an even more robust framework for developers to combat increasingly sophisticated, always-evolving cyberthreats.

The growing importance of SAS in Singapore’s digital economy

For now, SAS 2.0 is just a recommendation. But app owners should take it seriously. The guidelines might not be legally binding today, but they could soon become the go-to standard for mobile app security in Singapore. Ignoring them could lead to a loss of trust from users. For apps that handle sensitive transactions, that’s a risk no developer should take.

Singapore is a major financial hub, and protecting its digital economy is a top priority. As cyberattacks grow more sophisticated, regulators may decide to enforce these standards in a more rigorous fashion. If that happens, developers must invest in stronger security measures or would potentially face repercussions for non-compliance. Although that’s not the case yet, the speed at which these standards are published serves as an indicator of their importance for top officials.

The introduction of SAS 2.0, even without legal mandates, is poised to make a big impact in the mobile app development world. As more developers start referring to it for guidance, users will likely begin to expect such implementations. 

By embracing SAS 2.0, developers are expected to experience fewer security gaps and earn greater trust from users. On the other hand, developers who overlook these practices may find it harder to retain user confidence and could risk becoming an even more appealing target for cyberattacks.

The Safe App Standard 2.0 isn’t just another update. It’s a significant leap forward in mobile app security awareness. By zeroing in on high-risk apps and pushing for essential security controls like anti-tampering and anti-reverse engineering, SAS 2.0 sets the stage for a proactive approach to mobile security. 

Instead of waiting for potential attacks, powerful defenses can transform an app into a challenging target that simply makes criminals move on down the road.

Verimatrix XTD: An innovator in anti-tampering and anti-reverse engineering

Honored with multiple industry awards for its innovations in anti-tamper and anti-reverse engineering, Verimatrix XTD is trusted by developers around the world to safeguard their mobile app as well as their revenues and reputation. Request to talk to a Verimatrix XTD specialist today.