Sharpen These App Security Skills to Stand Out as a Developer

Developers aren’t necessarily security professionals, but secure coding is a discipline that can serve both iOS and Android developers alike. Not only can AppSec skills help protect an organization against threats, they can also make coders even more marketable.

One of the biggest challenges of AppSec is that developers need to operate in a context of zero trust. The device itself and the application could become a target at any given moment.  For example, hackers may clone or repackage apps with malicious code, or reverse-engineer apps to steal IP or sensitive data. Organizations like OWASP have dedicated top 10 lists for application security risks, which will continue to arise if developers aren’t diligent about protecting their code.

Here are a few ways in which app developers and engineers can sharpen their secure coding skills to prevent successful attacks to their iOS and Android apps.

Participate in Bug Bounties

While there’s no substitute for real-world experience, bug bounties, such as Google’s Vulnerability Reward Program can help you identify vulnerabilities that need to be addressed. Programs like these will reward developers for discovering vulnerabilities in Google’s own applications, including remote code execution, unrestricted file system or database access, logic flaw bugs and more.

Once you’ve learned how to identify some of these bugs in the wild, you can perform penetration testing on your own applications to determine where there are points of vulnerability, and remediate them before they become larger problems for your organization.

Learn Common Code Hardening Techniques

Both Android and iOS applications and SDKs can easily be reverse-engineered by hackers, which can expose source code and API keys or lead to cloning or repackaging counterfeit versions of your apps (complete with security vulnerabilities included). Fortunately, code obfuscation—that is, rendering code illegible without affecting its functionality—can prevent hackers from exploiting applications. In addition, encryption ensures that the code of the application, as well as its data, cannot be accessed while the application is at rest.

It can be helpful to understand some of the basic techniques so you know exactly how your application’s code will be impacted. For example, some of the most common code obfuscation and encryption techniques are:

• Arithmetic obfuscation: using simple arithmetic and logical expressions to create equivalents in code
• Name obfuscation: replacing readable names in code with illogical equivalents. Solutions such as ProGuard can help you try this basic obfuscation technique
• Control flow obfuscation: modifying the code’s logic to make it less predictable and more difficult to trace
• String encryption: uses random encryption for each string, or scrambles strings
• Asset encryption: encrypts files in the asset directory so they’re unreadable by hackers
• Resource encryption: encrypts the resources within the apps themselves, including the data

Developers should understand these techniques and the impact on their apps well enough to be able to make strategic decisions about trade-offs that are worthwhile for the security benefits they provide. Software that obfuscates and encrypts code, such as DexGuard for Android and iXGuard for iOS, can help automate some of these processes for you as a developer.

Protect Against Dynamic Attacks

Testing apps for vulnerabilities during their development and QA phases is another important part of making sure that the application is ready for prime time. However, runtime application self-protection, or RASP, provides an additional layer of security against dynamic attacks. Since many security attacks happen in real time, it’s important to have a mechanism in place to block the attacks and protect the app’s vulnerable assets.

RASP works by monitoring the integrity of the application and the environment in which it is running in real time. As a result, the application developer would receive a security notification if a third party tampers with their app, and/or a hacker’s session within the application would be terminated immediately upon any wrongdoing.

Deploying Static and Dynamic App Protection

Guardsquare’s mobile app protection solutions help developers secure their completed applications, ensuring that a combination of best practices including RASP, code hardening, and vulnerability management are in place to prevent common security issues. The era of secure coding is here for applications, and developers can no longer rely on the default requirements of app stores to protect their sensitive data and IP from hackers (even iOS).

Starting with these three areas, developers can hone their skills and protect their organizations against security threats.