![](bg2.png)
ular, market of interest are explored by special soft-
ware components, crawlers, that collect information
related to Apps, analyze them and generate alerts to
inform office delegated of Apps removal from stores.
The main limitation of such an approach is that mar-
ket exploration and alerts production are driven by
keywords and this may have limitations when, for in-
stance, the language of the market is not supported
or the malicious developer does not use expected pat-
terns of keywords in the description of Apps.
In this paper we propose to extend the traditional
proactive approach with a logo recognition compo-
nent. The idea is that even when the keywords are
completely unrelated to the distributed App, at least
the logo resembles that of the application the devel-
oper wants to use in its fraudulent intents. Hence,
a logo recognition system can fruitfully enhance the
traditional approach based on keywords.
The paper is organized as follows. In Section 2 we
describe the typical management of Mobile Apps se-
curity with the description of a real case scenario. The
proposed approach is defined and analyzed in Sec-
tions 3 and 4, whereas in Sectio 5 a performance as-
sessment is presented. Section 6 ends the paper with
conclusions and final remarks.
2 SECURITY MANAGEMENT
The Forum of Incident Response and Security
Teams (FIRST, 2016) is an international organization,
founded in 1990, which hosts the Computer Emer-
gency Response Teams (CERT) coordination cen-
ter (CERT, 2016). There are more than 350 CERTs
world-wide. Their purpose is to collect and process
data about cyber security threats as well as defining
countermeasures and guidelines for the various stake-
holders. A CERT carries out different tasks, being
incident management one of the most important. The
goal of the incident management process is to contin-
uously increase the preparation and protection levels.
To this aim, incident management goes through the
phases depicted in Figure 1.
The process is constantly fed by data about ongo-
ing security events. For instance, obtained through
monitoring some resources, requests from citizens
and other entities, reports of known authorities and
more. As a result of the process, the CERT produces
a number of artefacts including security reports and
countermeasures.
Internally, the incident management process relies
on three tasks.
• Detection, which is carried out to precisely iden-
tify and characterize the security event and its fea-
Figure 1: Incident Management.
tures, e.g., to distinguish between system vulner-
abilities and malware reports.
• Analysis, which specifically targets a security
event with dedicated techniques to effectively as-
sess it and to understand its scope and implica-
tions.
• Response, which generates the appropriate secu-
rity artefacts for the event, e.g., countermeasures
for attacks and best practices to avoid a vulnera-
bility.
Clearly, efficiency and effectiveness are funda-
mental for minimizing the impact of such security
events. These requirements are typically not met by
manual processes and automation is often necessary.
In this paper we use as model Poste Italiane, which is
the largest infrastructure in Italy in the area of mail
delivery, logistics, financial and insurance services.
Poste Italiane offers a wide array of services to citi-
zens, businesses and to the Public Administration and
some of them are based on Apps.
Poste Italiane (PI) hosts one of the active CERTs
in Italy (PI CERT, 2016). For the reasons stated
above, the PI CERT has a strong interest in devel-
oping and acquiring new technologies for improving
its responsiveness and effectiveness. About the mo-
bile applications security, on which Poste Italiane is
investing more and more as their digital service deliv-
ery tool, the CERT has made a security methodology
(as shown in Figure 2) that allows to target monitoring
and analysis of the entire mobile application asset.
The methodology targets all the existing Apps that
might negatively affect the assets and reputation of
Poste Italiane. For instance, tampered versions of of-
ficial Apps released on blackmarkets might carry ma-
licious instructions. Also, third party Apps interact-
ing with the digital services infrastructure of Poste
Italiane might misuse or compromise some sensitive
data of the users. Clearly, the complexity of the mon-
itoring activity largely depends on the total number
of applications and markets to be controlled. Ba-
sically, Poste Italiane has 19 official Android appli-
cation released on Google Play and 12 iOS applica-
ICISSP 2017 - 3rd International Conference on Information Systems Security and Privacy
568