Optimizing mobile test security without compromising quality

When it comes to mobile applications, financial firms have two priorities that aren’t always easy to align.

On the one hand, banks and other financial services organizations want to ensure that they test mobile apps thoroughly to deliver a good user experience. They have high quality standards, and mobile testing is essential to meet them.

On the other hand, financial companies have to meet very strict security requirements, and conventional approaches to mobile testing don’t always fit that goal.

Fortunately, there is a way to square this circle so that mobile apps can be thoroughly tested in a safe manner. The solution is to use an air-gapped test environment. This article explains what such an environment looks like and how it benefits financial companies in particular.

The what and why of air-gapped mobile testing

An air-gapped mobile test environment is an environment where engineers can run tests without connecting devices or applications to external networks in any way. All testing is performed using a local area network (LAN) that is completely disconnected from the Internet. The LAN can also be connected from other internal network resources that the business operates, if desired.

From a security perspective, test environments with air holes provide banks and other heavily regulated businesses with important security advantages. They ensure that security problems found elsewhere in a bank’s IT infrastructure cannot bleed over into mobile tests. They also minimize the risk that an Internet-borne attack, or a vulnerability lurking elsewhere in the company’s IT estate, could act as a vector through which malicious parties could gain access to sensitive data stored on mobile apps or devices under test.

In other words, if your test environment is completely disconnected at the network level, it is essentially immune to security issues that originate elsewhere.

In this regard, testing with the air gap provides a level of safety that is simply not possible to achieve by other means. Engineers can rely on tools like firewalls or virtual private networks to try to isolate mobile test environments from other resources, but there can be ways for attackers to get past these vectors. At the end of the day, complete disconnection is the only way to ensure the highest possible level of security during mobile testing.

Get the most out of offline testing

The challenge that banks and similar organizations often face when building air-gapped test environments is that in many cases, software test platforms do not deliver the same level of performance for air-gapped testing as they do in cloud-based test environments. , which is the most important test infrastructure for companies with less stringent security requirements.

As a result, financial companies may find themselves trading test coverage and rigor for security—a problem if they want to optimize user experience while maximizing security.

That said, there are exceptions. When choosing a mobile testing solution that offers an air-gapped option, companies should verify that the air-gapped implementation supports the following key features:

• The ability to run accessibility and performance tests using AI/ML automation. Without these tests, organizations run the risk of delivering software that doesn’t meet users’ expectations because they weren’t able to test it as rigorously.
• Support for complete disconnection, if desired. To maximize security, air-gapped test services should be able to set up LANs that are completely disconnected from all other networks when users require it.
• Support for scriptless automation. Scriptless automation is another feature that helps businesses get the most out of mobile testing, but is sometimes not available with air-gapped testing.
• Support for running UI tests. User interface (UI) tests are also critical to optimizing application quality, and companies should not have to skimp on UI quality assurance to use air-gapped testing.

Simply put, organizations should ensure that they get the same features and functionality from air-gapped tests as they would from a conventional test cloud. That way, there is no need to let security become the enemy of quality or performance.

Testing without compromise

Air gap testing is a great way to improve safety. This makes tests with the air gap particularly valuable in industries such as finance where security requirements are very high, and where companies are constantly being probed by attackers for vulnerabilities that they can exploit.

However, air-gapped testing should not come at the expense of test functionality. When devising a test strategy with air gaps, it is critical to ensure that you get the same features in your local test environment as you would from a web-based mobile testing solution. It is the only way to guarantee quality and safety at the same time.

About the author: Frank Moyer is the CTO of Cobiton.