Application Hardening and Shielding

Application Hardening and Shielding

Application Hardening
Application hardening: a means of reducing risks stemming from reverse-engineering, tampering, and invasive monitoring.

Application Shielding
Application shielding: a means to help prevent, detect and/or respond to potential or actual application-level intrusions.

Risks
For applications that process or give access to sensitive data or functionality, the potential risks of NOT applying some form of hardening and/or shielding may include:
 * Intellectual Property theft
 * Piracy
 * Vulnerability discovery
 * Malware-based exploits
 * Unauthorized data access and breaches.

Regulations
The growing emphasis on application hardening and shielding as a required application security layer is fueling regulatory and statutory changes including (but not limited to)
 * 2016: Defend Trade Secret Act and EU Directive 943: These coordinated updates to trade secret theft protection are notable in that reverse engineering is explicitly excluded from the definition of misappropriation (theft) – meaning that courts will not consider IP made accessible via reverse-engineering to be treated as a “secret” – and, as such, that IP could not be protected under these laws. This legislation created an entire new set of obfuscation use cases.
 * 2017: DFARS and PCI Mobile: In each of these two very different control frameworks, Least Privilege risk mitigation controls were updated to require active anti-debug & anti-root/jailbreak controls.
 * 2017: 2018 PCI PIN Entry and GDPR: Both transactional security and personal privacy standards declare code security and data protection to be inseparable – security by design and by default.

Industry Consensus
One hundred percent industry consensus around application protection and security is impossible to achieve. However, OWASP is trying to create quality go-to guidelines. It recently released new protection guidelines around how mobile apps handle, store and protect sensitive information. For example, the OWASP Mobile Application Security Verification Standard under section V8: Resiliency Against Reverse Engineering Requirements among other things recommends that apps:
 * Detect and respond to the presence of a jailbroken device
 * Prevent or detect debugging attempts
 * Include multiple defense mechanisms
 * Leverage obfuscation and encryption

Conclusion
Application hardening along with layered security measures are recognized as a critical component of overall IT compliance. Be familiar with applicable standards and regulations; and implement app development best practices to enhance security for all your apps that process or give access to sensitive data or functionality. And, perhaps an obvious confirmation, but application hardening is meant to complement, not replace other security controls. See the OWASP Mobile Security Testing Guide for an comprehensive information on mobile application security.