By Jan Sysmans, Head of Marketing- Asia Pacific &Japan (APJ) at Appdome
Super Apps like PayTM, Tata Neu and MyJio are quickly becoming more essential for millions of Indian citizens today. They are the “Swiss Army Knife of apps” because they support a big range of services – shopping, financial services, entertainment streaming, rideshare, travel booking, healthcare, and more – from one app.
India’s Super App revolution is brewing
While India is an emerging Super App nation, the global market (valued at US$ 61.3 billion today) is expected to increase at a CAGR rate of 27.8% from 2023 to 2030.
Gartner predicts that more than 50% of the global population will be active users by 2027, and India will be near the top in usage. India’s rise will be driven by smartphone penetration – predicted to reach 87.7% by 2030 (from 54.2% in 2022) – the consumer internet market is also estimated to surpass US$ 1.6 trillion by 2025. Gen-Zers and Millennials will lead India’s Super App charge with food delivery, fintech, digital banking, ride-sharing, and e-commerce anticipated to be the most in-demand services.
Given their popularity and super convenience, there is a lot to look forward to – but there is also a lot to improve. Prime Minister Modi said cybersecurity is a national security priority because India has one of the highest rates of Android infections today.
Security is not simply putting up “stop” signs – it’s a balancing act. On one hand, Super app developers believe the key to driving up engagement, customer loyalty and average revenue per user or ARPU comes from presenting all services in a single app. Achieving this, however, requires careful integration and allowing an unprecedented level of third-party components like Buy Now Pay Later deals, loyalty, or P2P market buying functions inside the app.
Control is stretched. A single-purpose app developer, for example, can control workflows, Application Programming Interfaces, network calls, read/write functions, etc. In a Super App framework, however, these functions are provided by third parties and include components that were not designed to work together. This can lead to data theft and leakage threats at the interface points.
Considering these issues, here are five of the most common security threats that developers must anticipate in order to build robust threat prevention:
- Insecure Data Storage
Super App developers often lack control over how the “other” elements in the apps store, share, protect or transmit personal data including payment, health, brand preferences, and more. Data theft or leakage occurs at the intersection of these areas, and the connection between these services and cloud servers. Plugging these gaps requires a security model that includes data-at-rest protection, data-in-transit protection, anti-debugging, anti-hooking, anti-instrumentation, and other protections.
Super Apps also need more than one protection model because developers have to manage a complex compatibility matrix, match protections with source code and third-party components in the app, all with limited control over the technologies used by third parties. Security usually suffers, unless the developer and security professional can adopt an agile security product capable of protecting all frameworks and methods in any app simultaneously.
- Insufficient Protections
Super App designers often prioritize user needs before addressing challenges posed by hackers. But we regularly see code scanning vendors having a field day with Super Apps – running them on jailbroken or rooted devices – devices infected with mobile malware, or older operating systems without the latest OS security updates.
Given their popularity, Super Apps are a prize target for hackers and others. And “weaponizing” a Super App can be achieved by simply attacking one part of the app like its BNPL or driver functionality to disrupt.
- Weak Data-In-Transit Protection, Lack of Certificate Validation and Certificate Pinning
Super Apps comprise multiple, critical, interdependent service endpoints, each of which should be protected with secure certificate pinning. Protecting the critical login and main mobile service endpoints, and other vital connections is essential for the functioning of an app. For Super Apps, adding one more network-based protection to the security mix is recommended. Network security solutions impact the performance of the app and typically handle one endpoint at a time.
Playing a straight bat
Built for engagement, Super Apps are expected to be a dominant digital platform in the near term. To optimize this opportunity, aspiring Indian developers – like great cricket batters – must develop a strong, agile defensive foundation first. A “straight bat” defense is needed to stay ahead of hackers and cybercriminals.
