This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Application Hardening and Shielding"
(Added an article on App Hardening and App Shielding) |
(Combined definitions for app hardening and app sheilding) |
||
| Line 1: | Line 1: | ||
Application Hardening and Shielding | Application Hardening and Shielding | ||
| − | == | + | |
| − | + | == App Hardening and Shielding == | |
| − | + | A set of technologies that typically modify an application’s binary code to make it more resistant to reverse-engineering, tampering, invasive monitoring and intrusion. Enterprises harden their applications to protect their software assets and the data touched by the application. | |
| − | |||
== Risks == | == Risks == | ||
| − | For applications that process | + | For applications that contain unique IP or process sensitive data or functionality, the potential risks of NOT applying some form of hardening and/or shielding may include: |
*Intellectual Property theft | *Intellectual Property theft | ||
*Piracy | *Piracy | ||
*Vulnerability discovery | *Vulnerability discovery | ||
*Malware-based exploits | *Malware-based exploits | ||
| − | *Unauthorized data access and breaches | + | *Unauthorized data access and breaches |
== Regulations == | == Regulations == | ||
The growing emphasis on application hardening and shielding as a required application security layer is fueling regulatory and statutory changes including (but not limited to) | The growing emphasis on application hardening and shielding as a required application security layer is fueling regulatory and statutory changes including (but not limited to) | ||
| Line 24: | Line 23: | ||
* Leverage obfuscation and encryption | * Leverage obfuscation and encryption | ||
== Conclusion == | == Conclusion == | ||
| − | + | App hardening and shielding along with layered security measures are recognized as a critical component of overall IT compliance. Be familiar with applicable standards and regulations; and implement app development best practices to enhance security for all your apps that process or give access to sensitive data or functionality. | |
And, perhaps an obvious confirmation, but application hardening is meant to complement, not replace other security controls. See the [https://www.owasp.org/index.php/OWASP_Mobile_Security_Testing_Guide OWASP Mobile Security Testing Guide] for an comprehensive information on mobile application security. | And, perhaps an obvious confirmation, but application hardening is meant to complement, not replace other security controls. See the [https://www.owasp.org/index.php/OWASP_Mobile_Security_Testing_Guide OWASP Mobile Security Testing Guide] for an comprehensive information on mobile application security. | ||
== Further Reading == | == Further Reading == | ||
Revision as of 19:43, 21 March 2018
Application Hardening and Shielding
App Hardening and Shielding
A set of technologies that typically modify an application’s binary code to make it more resistant to reverse-engineering, tampering, invasive monitoring and intrusion. Enterprises harden their applications to protect their software assets and the data touched by the application.
Risks
For applications that contain unique IP or process sensitive data or functionality, the potential risks of NOT applying some form of hardening and/or shielding may include:
- Intellectual Property theft
- Piracy
- Vulnerability discovery
- Malware-based exploits
- Unauthorized data access and breaches
Regulations
The growing emphasis on application hardening and shielding as a required application security layer is fueling regulatory and statutory changes including (but not limited to)
- 2016: Defend Trade Secret Act and EU Directive 943:
These coordinated updates to trade secret theft protection are notable in that reverse engineering is explicitly excluded from the definition of misappropriation (theft) – meaning that courts will not consider IP made accessible via reverse-engineering to be treated as a “secret” – and, as such, that IP could not be protected under these laws. This legislation created an entire new set of obfuscation use cases. - 2017: DFARS and PCI Mobile:
In each of these two very different control frameworks, Least Privilege risk mitigation controls were updated to require active anti-debug & anti-root/jailbreak controls. - 2017: 2018 PCI PIN Entry and GDPR:
Both transactional security and personal privacy standards declare code security and data protection to be inseparable – security by design and by default.
Industry Consensus
One hundred percent industry consensus around application protection and security is impossible to achieve. However, OWASP is trying to create quality go-to guidelines. It recently released new protection guidelines around how mobile apps handle, store and protect sensitive information. For example, the OWASP Mobile Application Security Verification Standard under section V8: Resiliency Against Reverse Engineering Requirements among other things recommends that apps:
- Detect and respond to the presence of a jailbroken device
- Prevent or detect debugging attempts
- Include multiple defense mechanisms
- Leverage obfuscation and encryption
Conclusion
App hardening and shielding along with layered security measures are recognized as a critical component of overall IT compliance. Be familiar with applicable standards and regulations; and implement app development best practices to enhance security for all your apps that process or give access to sensitive data or functionality. And, perhaps an obvious confirmation, but application hardening is meant to complement, not replace other security controls. See the OWASP Mobile Security Testing Guide for an comprehensive information on mobile application security.
Further Reading
- PCI Mobile Payment Acceptance Security Guidelines for Developers
- GDPR - Data protection by design and by default
- Defend Trade Secrets Act of 2016
- Five Mobile App Security Techniques Hackers Don’t Want You to Use
- Article:What Approach to Application Hardening is Right For You?
- Article:Technology Trust Issues When Running in UNTRUSTED Environments? Try Application Shielding
