Question

A privacy engineer is hardening a mobile banking app that transmits personal financial data to backend APIs over TLS. During a threat assessment, the team identifies that attackers on compromised or corporate-proxied networks could present fraudulent certificates trusted by the device's OS trust store, enabling interception of personal data. Which technical control most directly mitigates this specific interception risk at the mobile endpoint?

Accepted Answer

Certificate pinning that validates the server certificate or public key against a known set bundled in the app

Answer

Upgrading the TLS cipher suites to enforce AES-256-GCM and forward secrecy

Answer

Encrypting the personal data payload at rest on the device using the platform keystore

Answer

Requiring step-up biometric authentication before the app calls sensitive backend APIs