Developing security for mobile apps on android
This unit covers developing security for Android mobile apps, including application, network, and data security, as well as secure Java coding practices. Learners will understand how to protect apps from common vulnerabilities and threats.
Assessment criteria
Topic Overview
The City & Guilds Level 3 Diploma in ICT Systems Support is a vocational qualification designed to equip students with the practical skills and theoretical knowledge needed to support and maintain ICT systems in a professional environment. This diploma covers a broad range of topics including hardware installation, software configuration, network management, security, and troubleshooting. It is ideal for those aiming to become IT support technicians, network administrators, or helpdesk analysts, providing a solid foundation for entry-level roles or further study in computing.
The qualification is structured around core units that address real-world scenarios, such as setting up and maintaining computer systems, managing networks, and ensuring data security. Students learn to diagnose and resolve technical issues, communicate effectively with users, and apply industry-standard practices. The diploma emphasizes hands-on experience, with assessments often involving practical tasks and written exams that test both knowledge and application. By the end of the course, students should be confident in supporting ICT infrastructure in small to medium-sized enterprises.
This diploma fits into the wider subject of Computer Science by focusing on the operational and support aspects of technology, complementing more theoretical areas like programming or systems analysis. It bridges the gap between technical knowledge and customer-facing support roles, making it highly relevant for the modern workplace. Understanding this qualification helps students appreciate how ICT systems are deployed, maintained, and secured, which is critical for any technology-driven career.
Key Concepts
Core ideas you must understand for this topic
- →Hardware and software installation: Understanding the process of setting up operating systems, drivers, and applications, including troubleshooting installation failures.
- →Network configuration and management: Knowledge of IP addressing, subnetting, DNS, DHCP, and basic router/switch setup to ensure connectivity and performance.
- →Security best practices: Implementing firewalls, antivirus software, user authentication, and data encryption to protect systems from threats.
- →Troubleshooting methodology: Systematic approach to identifying, diagnosing, and resolving hardware, software, and network issues using tools like event viewer and command-line utilities.
- →Customer service and communication: Effectively interacting with users to gather information, explain solutions, and provide training on ICT systems.
Learning Objectives
What you need to know and understand
- Understand application security, Understand application security features, Understand network security, Understand data security, Understand secure Java coding
- Understand application security, Understand application security features, Understand network security, Understand data security, Understand secure Java coding
- Understand application security, Understand application security features, Understand network security, Understand data security, Understand secure Java coding
- Understand application security, Understand application security features, Understand network security, Understand data security, Understand secure Java coding
- Understand application security, Understand application security features, Understand network security, Understand data security, Understand secure Java coding
- Understand application security, Understand application security features, Understand network security, Understand data security, Understand secure Java coding
- Understand application security, Understand application security features, Understand network security, Understand data security, Understand secure Java coding
- Understand application security, Understand application security features, Understand network security, Understand data security, Understand secure Java coding
- Understand application security, Understand application security features, Understand network security, Understand data security, Understand secure Java coding
Assessment Criteria
Key criteria assessors look for in your portfolio
- Understand application security.
- Understand application security features.
- Understand network security.
- Understand data security.
- Understand secure Java coding.
- Explain key Android security features and their purposes.
- Identify common network security threats and mitigation techniques.
- Describe data security measures such as encryption and secure storage.
- Apply secure coding practices in Java to prevent vulnerabilities.
- Explain the principles of application security on Android.
- Implement secure data storage using encryption.
- Configure network security to prevent eavesdropping.
- Write Java code that avoids common vulnerabilities like SQL injection.
- Understands application security principles.
- Implements security features like authentication.
- Secures network communications.
- Applies secure coding practices in Java.
- Explain the importance of application sandboxing and permissions.
- Describe how to secure network communications using SSL/TLS.
- Identify common data storage vulnerabilities and how to mitigate them.
- Apply secure coding principles to prevent injection attacks.
- Understand the role of encryption in protecting sensitive data.
- Award credit for accurately identifying and explaining Android platform security features (e.g., Android Keystore, permissions model, app sandboxing).
- Award credit for demonstrating implementation of secure network communication using HTTPS/TLS with certificate pinning in an Android app.
- Award credit for correctly applying data encryption techniques for data at rest and in transit, including appropriate use of Android's crypto APIs.
- Award credit for producing Java code that adheres to secure coding guidelines (e.g., input validation, proper handling of sensitive data, avoiding hard-coded secrets).
- Award credit for evaluating and mitigating specific security threats such as SQL injection, insecure data storage, and man-in-the-middle attacks within the context of Android development.
- Explain key application security features.
- Describe network security measures for mobile apps.
- Identify data security risks and mitigations.
- Apply secure coding practices in Java.
- Understand authentication and authorisation mechanisms.
- Implement secure coding practices to prevent vulnerabilities.
- Use Android security features like permissions and encryption.
- Secure network communications using HTTPS and certificates.
- Protect data at rest and in transit.
- Explains application security principles for Android.
- Identifies and implements security features (e.g., permissions).
- Describes network security measures (e.g., HTTPS, encryption).
- Applies data security techniques (e.g., secure storage).
- Demonstrates secure Java coding practices.
Assessment Guidance
Guidance for achieving higher grades
- 💡Practice implementing encryption for data at rest and in transit.
- 💡Learn about OWASP Mobile Top 10 risks.
- 💡Use secure coding guidelines and tools like lint to check code.
- 💡Familiarise yourself with OWASP Mobile Top 10 risks.
- 💡Practise writing secure code snippets for common scenarios.
- 💡Use Android Studio's security analysis tools during development.
- 💡Learn the Android security model and permissions.
- 💡Practice using tools like ProGuard for code obfuscation.
- 💡Understand OWASP Mobile Top 10 risks.
- 💡Always validate user input.
- 💡Use HTTPS for network calls.
- 💡Encrypt sensitive data at rest.
- 💡Use real-world examples of Android security breaches to illustrate points.
- 💡Practice writing secure code snippets for common scenarios.
- 💡Review Android security documentation and best practices.
- 💡In your evidence, clearly document the security measures you have implemented, including screenshots and code snippets demonstrating secure practices.
- 💡Refer to the OWASP Mobile Top 10 and map your controls to specific vulnerabilities to show thorough understanding.
- 💡For practical assessments, test your app against common security testing tools (like MobSF) and include results in your documentation.
- 💡When writing Java code, follow the principle of least privilege: request only the permissions your app needs and handle sensitive data in memory carefully.
- 💡Ensure you can explain the rationale behind each security decision, not just the implementation, to satisfy the 'Understand' learning outcomes.
- 💡Focus on OWASP Mobile Top 10 risks.
- 💡Practise identifying security flaws in code snippets.
- 💡Understand the Android permission model.
- 💡Keep up with Android security best practices.
- 💡Test your app for common vulnerabilities.
- 💡Understand the principle of least privilege.
- 💡Familiarise yourself with Android security documentation.
- 💡Practice secure coding by reviewing common vulnerabilities.
- 💡Understand the Android permission model thoroughly.
- 💡Always use technical terminology correctly (e.g., 'RAM' not 'memory stick') and define acronyms when first used to show understanding.
- 💡In practical assessments, demonstrate a logical troubleshooting sequence and explain your reasoning aloud or in written form to earn method marks.
- 💡For written exams, read questions carefully to identify command words (e.g., 'describe', 'explain', 'evaluate') and tailor your response accordingly—don't just list facts.
Common Mistakes
Common errors to avoid in your coursework
- Storing sensitive data in plain text or insecure locations.
- Ignoring input validation leading to injection attacks.
- Using outdated libraries with known vulnerabilities.
- Ignoring input validation leading to injection attacks.
- Storing sensitive data in plaintext or insecure locations.
- Neglecting to update libraries and dependencies for security patches.
- Storing sensitive data in plain text.
- Ignoring certificate validation in HTTPS connections.
- Using insecure coding practices like hardcoded credentials.
- Storing sensitive data insecurely.
- Ignoring input validation.
- Using weak encryption methods.
- Storing sensitive data in plain text or using weak encryption.
- Failing to validate input, leading to injection vulnerabilities.
- Ignoring certificate validation in network connections.
- Assuming that Android's default security settings are sufficient without additional app-level protections.
- Storing sensitive data in plain text in SharedPreferences or external storage.
- Not implementing certificate pinning, leaving the app vulnerable to MITM attacks even with HTTPS.
- Hard-coding API keys or passwords in the source code, which can be extracted from the APK.
- Neglecting to validate all user inputs, leading to injection flaws.
- Confusing encryption with hashing.
- Overlooking input validation vulnerabilities.
- Neglecting secure storage of sensitive data.
- Hardcoding sensitive information like API keys.
- Ignoring input validation leading to injection attacks.
- Using insecure data storage methods.
- Hardcoding sensitive information like API keys.
- Ignoring proper input validation and sanitisation.
- Using insecure data transmission protocols.
- Misconception: 'Troubleshooting is just guessing and checking.' Correction: Effective troubleshooting follows a structured process (e.g., identify problem, establish theory, test, implement solution, verify) to ensure efficiency and accuracy.
- Misconception: 'Network security is only about passwords.' Correction: Security involves multiple layers including physical security, access controls, encryption, regular updates, and user education.
- Misconception: 'All hardware problems require replacement.' Correction: Many issues can be resolved through driver updates, configuration changes, or cleaning; replacement is a last resort.
Revision Plan
How to revise this topic in 1–2 weeks
- 1Week 1, Days 1-2: Review hardware and software installation processes. Practice installing an OS in a virtual machine and document each step.
- 2Week 1, Days 3-4: Focus on networking fundamentals—study IP addressing, subnetting, and configure a small network using packet tracer or real equipment.
- 3Week 1, Days 5-7: Dive into security topics: firewalls, encryption, and user permissions. Create a checklist for securing a typical workstation.
- 4Week 2, Days 1-3: Practice troubleshooting scenarios. Use online simulators or past papers to work through common issues (e.g., no boot, network drop).
- 5Week 2, Days 4-5: Revise customer service skills and communication techniques. Role-play support calls with a peer.
- 6Week 2, Days 6-7: Take a full practice exam under timed conditions, then review mistakes and revisit weak areas.
Exam Question Types
How this topic typically appears in the exam
- 📋Multiple-choice questions testing definitions and basic concepts (e.g., 'What does DHCP stand for?'). Tip: Eliminate obviously wrong answers first.
- 📋Short-answer questions requiring explanations (e.g., 'Describe three steps you would take to troubleshoot a printer that won't print.'). Tip: Use bullet points for clarity but write in full sentences.
- 📋Scenario-based questions where you must apply knowledge (e.g., 'A user cannot connect to the internet. List possible causes and how you would investigate.'). Tip: Show a logical process and mention specific tools (e.g., ipconfig, ping).
- 📋Practical tasks in controlled assessments (e.g., 'Install and configure a network printer on a Windows domain.'). Tip: Follow safety procedures and document your steps.
Command Word Expectations (CITY & GUILDS LIMITED)
What examiners look for when using specific command words in this specification
Provide a detailed account of a process, feature, or concept. Include key characteristics and steps, but no evaluation. For example, 'Describe the steps to set up a static IP address.' Expectation: List and explain each step (e.g., open network settings, select IPv4, enter address, subnet mask, gateway, DNS).
Give reasons or causes for why something happens or how it works. Must include underlying principles. For example, 'Explain why a firewall is important for network security.' Expectation: Discuss how firewalls filter traffic, block unauthorized access, and prevent malware spread, with reference to rules and packet inspection.
Make a judgement based on evidence, discussing pros and cons. For example, 'Evaluate the use of cloud storage vs local storage for a small business.' Expectation: Compare factors like cost, accessibility, security, and reliability, and give a reasoned conclusion.
Active Recall Memory Test
Test your memory before revealing the key facts
Frequently Asked Questions
Common questions students ask about this topic
Pass / Merit / Distinction Evidence Checklist
How your portfolio evidence is graded for CITY & GUILDS LIMITED Developing security for mobile apps on android
Every vocational unit is marked against named criteria rather than an exam percentage. Your tutor's brief lists the exact codes for this unit — here is what each band is asking you to do.
Demonstrate baseline knowledge, accurate terminology, and core practical application.
Provide detailed analysis, structured explanations, and clear workplace reasoning.
Deliver thorough evaluation, original problem solving, and fully justified recommendations.
Before You Start
Prior knowledge that will help with this topic
- •Basic understanding of computer hardware components (CPU, RAM, storage) and their functions.
- •Familiarity with common operating systems (Windows, Linux) and basic file management.
- •Elementary networking concepts such as IP addresses and network topologies.
Coursework AI Review
Paste your assignment brief and check your draft against its P/M/D criteria
Key Terminology
Essential terms to know
- Understand application security, Understand application security features, Understand network security, Understand data security, Understand secure Java coding
- Understand application security, Understand application security features, Understand network security, Understand data security, Understand secure Java coding
- Understand application security, Understand application security features, Understand network security, Understand data security, Understand secure Java coding
- Understand application security, Understand application security features, Understand network security, Understand data security, Understand secure Java coding
- Understand application security, Understand application security features, Understand network security, Understand data security, Understand secure Java coding
- Understand application security, Understand application security features, Understand network security, Understand data security, Understand secure Java coding
- Understand application security, Understand application security features, Understand network security, Understand data security, Understand secure Java coding
- Understand application security, Understand application security features, Understand network security, Understand data security, Understand secure Java coding
- Understand application security, Understand application security features, Understand network security, Understand data security, Understand secure Java coding
Ready to learn?
AI-powered learning tailored to this unit