Update MASTG-BEST-0004 - Add Link to Security recommendations for bac…

…kups (#3118) * Update MASTG-BEST-0004 - Add Link to Security recommendations for backups * add links to android-risks
OWASP · Jan 17, 2025 · 65cbff3 · 65cbff3
1 parent 7436d7c
commit 65cbff3
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 0 deletions.
diff --git a/best-practices/MASTG-BEST-0004.md b/best-practices/MASTG-BEST-0004.md
@@ -9,3 +9,5 @@ For the sensitive files found, instruct the system to exclude them from the back
 
 - If you are using Auto Backup, mark them with the `exclude` tag in `backup_rules.xml` (for Android 11 or lower using `android:fullBackupContent`) or `data_extraction_rules.xml` (for Android 12 and higher using `android:dataExtractionRules`), depending on the target API. Make sure to use both the `cloud-backup` and `device-transfer` parameters.
 - If you are using the key-value approach, set up your [BackupAgent](https://developer.android.com/identity/data/keyvaluebackup#BackupAgent) accordingly.
+
+Refer to ["Security recommendations for backups - Mitigations"](https://developer.android.com/privacy-and-security/risks/backup-best-practices#security-recommendations-for-backups-mitigations) for more information.
diff --git a/weaknesses/MASVS-STORAGE/MASWE-0003.md b/weaknesses/MASVS-STORAGE/MASWE-0003.md
@@ -7,6 +7,8 @@ profiles: [L2]
 mappings:
   masvs-v1: [MSTG-STORAGE-8]
   masvs-v2: [MASVS-STORAGE-2, MASVS-PRIVACY-1]
+  android-risks:
+  - https://developer.android.com/privacy-and-security/risks/backup-best-practices
 
 refs:
 - https://developer.android.com/guide/topics/data/autobackup#define-device-conditions

diff --git a/weaknesses/MASVS-STORAGE/MASWE-0004.md b/weaknesses/MASVS-STORAGE/MASWE-0004.md
@@ -7,6 +7,8 @@ profiles: [L1, L2, P]
 mappings:
   masvs-v1: [MSTG-STORAGE-8]
   masvs-v2: [MASVS-STORAGE-2, MASVS-PRIVACY-1]
+  android-risks:
+  - https://developer.android.com/privacy-and-security/risks/backup-best-practices
 
 refs:
 - https://developer.android.com/guide/topics/data/autobackup#include-exclude-android-11
Original file line number	Diff line number	Diff line change
Expand Up		@@ -9,3 +9,5 @@ For the sensitive files found, instruct the system to exclude them from the back

		- If you are using Auto Backup, mark them with the `exclude` tag in `backup_rules.xml` (for Android 11 or lower using `android:fullBackupContent`) or `data_extraction_rules.xml` (for Android 12 and higher using `android:dataExtractionRules`), depending on the target API. Make sure to use both the `cloud-backup` and `device-transfer` parameters.
		- If you are using the key-value approach, set up your [BackupAgent](https://developer.android.com/identity/data/keyvaluebackup#BackupAgent) accordingly.

		Refer to ["Security recommendations for backups - Mitigations"](https://developer.android.com/privacy-and-security/risks/backup-best-practices#security-recommendations-for-backups-mitigations) for more information.