Runtime Vulnerability Analytics on mobile applications

[g_kat]

Hi,

Is Dynatrace's RVA(Runtime Vulnerability Analytics) applicable to mobile applications? I would guess not since I haven't seen any indication to it being possible, so I started wondering if it even makes sense to extend Application Security to mobile Applications under the current mobile monitoring scheme.

Is there any way this can be approached, or does it need a complete redesign of the mobile SDKs?

Thanks,

George

[Thomas_Wirth1]

Hey g_kat

No, Runtime Vulnerability Analytics is not available for mobile platforms. Here is a link to the supported technologies.

[PierreGutierrez · Accepted solution]

Hello @g_kat 

To complement what Thomas mentioned

The Runtime Vulnerability Analytics feature is not applicable to mobile application monitoring, as it relies on OneAgent to analyze security at the system process and Process Group level, which is not part of the mobile instrumentation workflow.

Although technologies such as Java or .NET can be used in mobile front-end development, mobile application monitoring in Dynatrace is performed through automatic or manual instrumentation via the Mobile SDK, which sends data directly to Dynatrace through an ActiveGate.

In this mentioned workflow, neither OneAgent nor the host process layer are involved, therefore, the runtime vulnerability analysis capabilities offered by this feature cannot be applied.

I recommend you to be able to generate Product ideas - Dynatrace Community  so that it can be evaluated 😄

Hope it's helpful 💪

[g_kat]

Thanks @PierreGutierrez  and @Thomas_Wirth1, you confirmed my thoughts.

Indeed, with the current Mobile SDK philosophy it doesn't make much sense getting RVA there, but I will post an idea just to test the waters, since security in mobile applications is a very "hot" area so to speak.

Thanks,

George

[PierreGutierrez]

Yes, it's a very interesting topic, and I think it's highly valuable from a security perspective.

Currently, there's Dynatrace Live Debugger, which focuses on the backend and its real-time code review.

I think that if they've already implemented this functionality, they could have something similar in the future for front-end application code, perhaps reaching the point of RVA.