In today’s connected world, network security settings can make or break your application’s defence. A single misconfiguration cracks open a door for attackers. The good news? You can lock it down with proven techniques—and CyberGuard is here to help.

Why Network Security Settings Matter

You build an app. You test it. You ship it. But what happens on the wire?
Unencrypted traffic. Rogue certificates. Man-in-the-middle.
Sounds scary. Because it is.

Network security settings let you control:

Which Certificate Authorities (CAs) your app trusts
Whether cleartext (HTTP) traffic is allowed
How certificates are pinned or checked for transparency
Special debug overrides during development

Get these right, and you close common attack vectors before they even start.

Core Components of Network Security Configuration

Most platforms—Android, iOS, server frameworks—offer a declarative way to tweak network security settings. Let’s break down four key areas:

1. Custom Trust Anchors

By default, apps trust all system CAs. But sometimes you want more control:

Trust a self-signed cert for your internal API
Limit trust to a handful of public CAs
Add new CAs not in the system store

Example: In an XML config, you point at your own my_ca.pem file and restrict every connection to that root. No more “unknown issuer” surprises.

2. Cleartext Traffic Opt-Out

HTTP traffic is unencrypted. And in hostile Wi-Fi zones, it’s downright dangerous. You can:

Opt out of cleartext globally (Android 9+ default)
Block it for critical domains
Opt in only where legacy endpoints demand it

This ensures your data moves over HTTPS wherever it truly matters.

3. Certificate Transparency Opt-In

Certificate Transparency (CT) logs force CAs to publish every cert they issue. Use CT to:

Prove a cert exists in a public log
Thwart attackers who spin up shady certificates
Enforce logging globally or per-domain

It’s another layer of proof that your server’s identity isn’t “off the grid.”

4. Certificate Pinning

Pinning locks your app to specific public keys:

Define a set of SHA-256 hashes in your pin set
Optionally include backup pins to avoid outages
Set an expiration date to allow smooth key rotations

If an attacker presents any other key, your app simply refuses the connection.

CyberGuard’s Best Practices for Bullet-Proof Settings

Hands-on configuration is one thing. Proactive defence is another. CyberGuard blends expertise and tooling across three pillars:

Penetration Testing
We simulate attacks on your network settings.
• Spot weak trust anchors.
• Validate your pinning logic.
• Ensure cleartext rules aren’t accidentally bypassed.
Cyber Security Awareness Training
Even the best config file fails if someone mis-uploads a PEM.
• We teach your team secure certificate management.
• Hands-on labs show how misconfigurations lead to breaches.
• Regular refresher courses keep skills sharp.
Cloud Infrastructure Management
Modern apps live in the cloud. Network security settings must scale:
• Containerised apps get uniform configs.
• Automated policy checks in CI/CD pipelines.
• Continuous monitoring of certificate validity.

These services work in concert. Config files, human training, and cloud governance—no gaps left open.

Step-By-Step: Securing Your App’s Network Settings

Let’s map out a simple workflow using Android’s XML config as an example. Even if you’re on another platform, the concepts translate.

Audit Your Default Settings
• List every domain your app calls.
• Check if cleartext is accidentally allowed.
• Identify any non-system CAs in use.
Define a Base Config
xml <network-security-config> <base-config cleartextTrafficPermitted="false"> <trust-anchors> <certificates src="system"/> </trust-anchors> </base-config> </network-security-config>
This blocks all HTTP by default and trusts only system CAs.
Add Domain-Specific Rules
xml <domain-config> <domain includeSubdomains="true">api.mycompany.com</domain> <trust-anchors> <certificates src="@raw/my_ca"/> </trust-anchors> <pin-set expiration="2026-01-01"> <pin digest="SHA-256">Base64HashHere=</pin> <pin digest="SHA-256">BackupHashHere=</pin> </pin-set> </domain-config>
You trust your private CA and pin against key hashes.
Enable Debug Overrides
xml <debug-overrides> <trust-anchors> <certificates src="@raw/debug_cas" overridePins="true"/> </trust-anchors> </debug-overrides>
Now, in debug builds only, you can use a local server’s self-signed cert without fear of a production release slipping through.
Test with CyberGuard
Schedule a penetration test. We’ll probe every rule, every hash, every fallback. No guesswork.

Common Pitfalls and How to Avoid Them

Even experienced teams slip up. Watch out for:

Missing Backup Pins
Forgetting a secondary pin? One CA roll-over, and your app goes dark.
Overly Permissive Debug Settings
Shipping a debuggable release with overridePins="true" is a ticking bomb.
Neglected Certificate Expiry
Certs expire. So do pins. Automate checks or risk sudden outages.

CyberGuard’s compliance expertise—ISO 27001, Cyber Essentials, SOC 2—ensures you tick every regulatory box.

Conclusion

Network security settings are your first line of defence. They stop threats before they start. But setting them up and keeping them right? That’s where many teams struggle. Don’t go it alone.

Lock down trust anchors.
Block cleartext traffic.
Pin and log certificates.
Train your team.
Regularly test with experts.

Ready to strengthen your application’s network security settings? Learn how CyberGuard’s Penetration Testing, Cyber Security Awareness Training and Cloud Infrastructure Management can keep you safe and compliant.

Contact us today at https://www.primoconnect.co.uk and secure your path to a resilient future.