This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit

Application Hardening and Shielding

Jump to: navigation, search

Application Hardening and Shielding

App Hardening and Shielding

A set of technologies that typically modify an application’s binary code to make it more resistant to reverse-engineering, tampering, invasive monitoring and intrusion. Enterprises harden their applications to protect their software assets and the data touched by the application.


For applications that contain unique IP or process sensitive data or functionality, the potential risks of NOT applying some form of hardening and/or shielding may include:

  • Intellectual Property theft
  • Piracy
  • Vulnerability discovery
  • Malware-based exploits
  • Unauthorized data access and breaches


The growing emphasis on application hardening and shielding as a required application security layer is fueling regulatory and statutory changes including (but not limited to)

  • 2016: Defend Trade Secret Act and EU Directive 943:
    These coordinated updates to trade secret theft protection are notable in that reverse engineering is explicitly excluded from the definition of misappropriation (theft) – meaning that courts will not consider IP made accessible via reverse-engineering to be treated as a “secret” – and, as such, that IP could not be protected under these laws. This legislation created an entire new set of obfuscation use cases.
  • 2017: DFARS and PCI Mobile:
    In each of these two very different control frameworks, Least Privilege risk mitigation controls were updated to require active anti-debug & anti-root/jailbreak controls.
  • 2017: 2018 PCI PIN Entry and GDPR:
    Both transactional security and personal privacy standards declare code security and data protection to be inseparable – security by design and by default.
  • 2018: NIST:
    National Institute of Standards and Technology publications include increasingly prescriptive obligations for application developers around data security.

Industry Consensus

One hundred percent industry consensus around application protection and security is impossible to achieve. However, OWASP is trying to create quality go-to guidelines. It recently released new protection guidelines around how mobile apps handle, store and protect sensitive information. For example, the OWASP Mobile Application Security Verification Standard under section V8: Resiliency Against Reverse Engineering Requirements among other things recommends that apps:

  • Detect and respond to the presence of a jailbroken device
  • Prevent or detect debugging attempts
  • Include multiple defense mechanisms
  • Leverage obfuscation and encryption


App hardening and shielding along with layered security measures are recognized as a critical component of overall IT compliance. Be familiar with applicable standards and regulations; and implement app development best practices to enhance security for all your apps that process or give access to sensitive data or functionality. And, perhaps an obvious confirmation, but application hardening is meant to complement, not replace other security controls. See the OWASP Mobile Security Testing Guide for an comprehensive information on mobile application security.

Further Reading