MASTG

The Mobile Application Security Testing Guide is OWASP’s practical testing companion for mobile apps. It translates security expectations into validation steps so testers can check whether an application actually meets the intended control standard.

Expanded Definition

MASTG refers to the OWASP Mobile Application Security Testing Guide, a structured set of testing practices for evaluating mobile application security across design, implementation, and runtime behaviour. It is not a product, scanner, or certification standard. Instead, it gives testers and assurance teams a repeatable way to verify whether security controls actually exist and function as intended in an Android or iOS context. In practice, MASTG is used alongside the OWASP Mobile Application Security Testing Guide and related OWASP mobile guidance to move from abstract requirements to evidence-based validation.

Definitions vary across vendors when they describe “mobile security testing” as if it were a single activity. In reality, MASTG spans static analysis, dynamic analysis, client-side storage review, transport security checks, authentication testing, and reverse engineering considerations. It is most useful when paired with a defined risk model and a clear acceptance threshold for findings. The most common misapplication is treating MASTG as a checklist for tool output, which occurs when teams mark controls “passed” without manually validating exploitability or security impact.

Examples and Use Cases

Implementing MASTG rigorously often introduces additional manual testing effort, requiring organisations to balance coverage depth against release speed.

• Pre-release assurance teams use MASTG scenarios to verify whether sensitive data is exposed in logs, caches, or insecure local storage before deployment.
• Mobile red teams apply MASTG methods to test certificate validation, pinning behaviour, and traffic interception resistance in customer-facing apps.
• Appsec engineers use MASTG to confirm that authentication flows, session handling, and token storage align with documented requirements rather than assumed vendor defaults.
• Developers and testers compare findings against the OWASP mobile guidance and the NIST Cybersecurity Framework 2.0 to map mobile issues to broader governance outcomes such as protect and detect.
• Assurance teams use MASTG during merger, acquisition, or third-party risk reviews when a mobile app becomes part of a regulated service and security evidence is required quickly.

Why It Matters for Security Teams

MASTG matters because mobile applications compress business logic, credentials, APIs, and user trust into a device that is far harder to govern than a controlled server environment. When teams misunderstand the guide, they often over-rely on automated scanners, under-test client-side trust boundaries, or fail to examine how secrets, tokens, and local data are handled on rooted or jailbroken devices. That creates blind spots in authentication, data protection, and session security that can affect both customer accounts and downstream services.

For identity-heavy mobile apps, MASTG is especially relevant because the mobile client often becomes the control point for login, enrolment, and step-up authentication. Weak testing can allow session theft, token replay, or bypass of device-bound protections. The guide also aligns well with governance expectations in the broader cyber control ecosystem, including the NIST Cybersecurity Framework 2.0 and OWASP mobile testing practices, because both emphasize verifying that controls work in practice, not only on paper. Organisations typically encounter the operational urgency of MASTG only after a mobile compromise, at which point structured testing becomes unavoidable to determine how the failure occurred.