IDC Authors Spotlight Paper Extolling Virtues of Application Hardening

In order to work, mobile apps must communicate with backend servers. Consider your banking app, which needs to securely access your account information to show you your account balances or allow you to transfer your money. The challenge arises when it comes to ensuring the security of these interactions. It’s not a matter of developers being imperfect in their coding efforts; rather, it stems from the inherent need for apps to include working examples that demonstrate how they communicate with backend servers.

Why is it a problem that apps must contain working examples of how to access back-end servers? Because consumer applications live outside the firewall. This means that anyone can do anything to them anytime they want. A threat actor, for example, can run the app in a jailbroken or rooted phone. Or in an emulator. Or in a debugger. The most critical problem arises when threat actors reverse engineer these apps and gain access to the information on how they establish communication with backend servers. Once in possession of this knowledge, threat actors can use it to steal sensitive data or carry out malicious activities. This challenge necessitates a different approach—one that analysts agree goes beyond achieving coding perfection.

The Role of App Hardening

IDC Senior Research Analyst Katie Norton believes application hardening should be a key component of an organization’s DevSecOps strategy. Application hardening works to secure an application by adding extra layers of protection to reduce the attack surface area and make it more difficult for attackers to reverse engineer the code, using build-time techniques such as code obfuscation and resource encryption. It should also include monitoring apps for tampering, and if tampering is detected, applications must have the ability to respond to attacks with runtime application self-protection (RASP). Further, application hardening must be tightly woven with DevSecOps security gates to ensure only hardened apps are released. These measures help protect the working examples that each app contains.

Obfuscation, Anti-Tamper Measures, and RASP

Code obfuscation is a key component of app hardening. It is a technique that transforms code to make it challenging for attackers to understand its functionality. Obfuscation removes contextual information that humans and decompilers rely on, thereby impeding reverse engineering and tampering attempts.

In addition to code obfuscation, app hardening ideally also incorporates anti-tamper measures to detect and respond to unauthorized attempts to modify or manipulate the application. These measures can identify unsafe environments, such as debuggers, emulators, or rooted/jailbroken devices, and trigger appropriate actions in real-time. By promptly detecting and responding to tampering incidents, organizations can mitigate potential risks and protect their applications from compromise.

Another critical aspect of app hardening is the integration of Runtime Application Self-Protection (RASP). RASP combines real-time analysis of the application with context awareness of the events that led to the current behavior of the application. With RASP, organizations gain visibility into the application’s logic and data flow, allowing for accurate identification of attacks and triggering of automatic protective actions.

App Hardening as an Essential Practice

The exponential growth of applications has also been met with unprecedented security breaches. In IDC’s 2023 DevSecOps Adoption, Techniques, and Tools Survey, the number of organizations indicating they experienced a security breach increased 21 percentage points over the prior year’s survey. With more applications being developed and deployed at a faster pace, the attack surface for cybercriminals increases, making it easier for them to reverse engineer the app and launch attacks.

App hardening is not limited to specific industries or application types. While highly regulated sectors like banking and healthcare have long recognized its importance, organizations across all industries should embrace app hardening as an essential practice. Any application that deals with sensitive data or provides potential access to critical resources can benefit from the enhanced security provided by app hardening.

The survey also found that developer security knowledge is the top organizational challenge concerning DevSecOps adoption. While organizations work toward increasing and deepening their developers’ understanding of secure coding, application hardening is key in filling this gap. To accomplish this, organizations must use a comprehensive suite of layered protection mechanisms that are not entirely dependent upon writing secure code. These mechanisms, as outlined by IDC, include strong obfuscation, compromised environment checks, code and data integrity checks, runtime monitoring, strong RASP reactions, and white-box cryptography to protect against common cryptographic attacks.

The Digital.ai Difference

Our app hardening begins with a Protection Blueprint, also known as a Guard Spec, which acts as a guide to configure or customize the hardening process. This entails building security protections into software at the compile stage, where a protection blueprint, written by your developers (or by Digital.ai to your specification or built automatically), is built into the code. The protected application contains obfuscated machine code that runs as originally designed but is virtually unreadable by threat actors — even after it has been fed into a disassembler.

Digital.ai can help ensure that nonhardened applications are not released without security protections in place when app hardening is an integrated part of DevOps workflows.

Conclusion

In an era where mobile applications rely on secure communication with backend servers, ensuring the integrity and protection of these interactions is paramount. The challenge lies not in the developers’ coding skills but in the inherent nature of apps requiring functional examples to demonstrate their communication mechanisms.

App hardening is emerging as a critical practice to enhance application security beyond the limitations of code alone, as emphasized by the insights revealed in IDC’s Spotlight paper¹. By integrating app hardening within DevOps workflows, organizations can ensure that security measures are seamlessly integrated into the development process without hindering agile and rapid application updates. It enables organizations to fortify their applications, detect tampering attempts, respond in real-time, and enhance overall application security.

It is crucial to understand that app hardening is not limited to mobile applications alone. As the number of web, desktop, and mobile applications grows and the threat landscape changes, adopting app hardening is becoming essential across app types. Protecting applications that handle sensitive data should be a priority for organizations seeking to safeguard their assets and maintain the trust of their customers.

By embracing app hardening as a vital practice within the development process, organizations can significantly reduce the risk of application compromises and ensure the protection of valuable resources and data. Remember, while coding perfection may be unattainable, app hardening enables organizations to strive for stronger and more resilient applications in the face of evolving cyber threats.

To learn more about how build-time application hardening improves security posture without placing an extra burden on developers, read the full Spotlight paper here.

¹IDC Spotlight Paper, Sponsored by Digital.ai: “The Need for Application Hardening as a Part of a Holistic DevSecOps Strategy” (#US50720023, May 2023)