Overview
One of the risks identified in risk assessment for ISO27001 is the possibility of logging exposing user sensitive data on the phone.
Control
The control for this risk would be to not log any exception data on the phone.
However, we want crash reports to be logged so this may not be entirely possible.
In addition debug mode needs to be on for development and testing.
So, we need to investigate ways to:
- Ensure the app does not work in 'debug' mode on 'Production' builds... the app should just refuse to work.
- Is there any place in the app that unencrypted user data (clearcase user data) is spit out into info logs or crash exceptions
- Will shutting off debug mode also prevent logging on the device?
Overview
One of the risks identified in risk assessment for ISO27001 is the possibility of logging exposing user sensitive data on the phone.
Control
The control for this risk would be to not log any exception data on the phone.
However, we want crash reports to be logged so this may not be entirely possible.
In addition debug mode needs to be on for development and testing.
So, we need to investigate ways to: