Application Hardening and Shielding

Application Hardening and Shielding

App Hardening and Shielding

A set of technologies that typically modify an application’s binary code to make it more resistant to reverse-engineering, tampering, invasive monitoring and intrusion. Enterprises harden their applications to protect their software assets and the data touched by the application.

Risks

For applications that contain unique IP or process sensitive data or functionality, the potential risks of NOT applying some form of hardening and/or shielding may include:

• Intellectual Property theft
• Piracy
• Vulnerability discovery
• Malware-based exploits
• Unauthorized data access and breaches

Regulations

The growing emphasis on application hardening and shielding as a required application security layer is fueling regulatory and statutory changes including (but not limited to)

• 2016: Defend Trade Secret Act and EU Directive 943:
  These coordinated updates to trade secret theft protection are notable in that reverse engineering is explicitly excluded from the definition of misappropriation (theft) – meaning that courts will not consider IP made accessible via reverse-engineering to be treated as a “secret” – and, as such, that IP could not be protected under these laws. This legislation created an entire new set of obfuscation use cases.
• 2017: DFARS and PCI Mobile:
  In each of these two very different control frameworks, Least Privilege risk mitigation controls were updated to require active anti-debug & anti-root/jailbreak controls.
• 2017: 2018 PCI PIN Entry and GDPR:
  Both transactional security and personal privacy standards declare code security and data protection to be inseparable – security by design and by default.
• 2018: NIST:
  National Institute of Standards and Technology publications include increasingly prescriptive obligations for application developers around data security.

Industry Consensus

One hundred percent industry consensus around application protection and security is impossible to achieve. However, OWASP is trying to create quality go-to guidelines. It recently released new protection guidelines around how mobile apps handle, store and protect sensitive information. For example, the OWASP Mobile Application Security Verification Standard under section V8: Resiliency Against Reverse Engineering Requirements among other things recommends that apps:

• Detect and respond to the presence of a jailbroken device
• Prevent or detect debugging attempts
• Include multiple defense mechanisms
• Leverage obfuscation and encryption

Conclusion

App hardening and shielding along with layered security measures are recognized as a critical component of overall IT compliance. Be familiar with applicable standards and regulations; and implement app development best practices to enhance security for all your apps that process or give access to sensitive data or functionality. And, perhaps an obvious confirmation, but application hardening is meant to complement, not replace other security controls. See the OWASP Mobile Security Testing Guide for an comprehensive information on mobile application security.

Further Reading

• PCI Mobile Payment Acceptance Security Guidelines for Developers
• GDPR - Data protection by design and by default
• Defend Trade Secrets Act of 2016
• Five Mobile App Security Techniques Hackers Don’t Want You to Use
• Article:Technology Trust Issues When Running in UNTRUSTED Environments? Try Application Shielding
• Article:What Approach to Application Hardening is Right For You?
• Article:NIST Publications reinforce the importance of application hardening in securing data