SecuremobileShieldX: A Crucial Component of Mobile App Security

“Case Study – Promon hacks Tesla app – In November 2016, Promon carried out a project which demonstrated how a lack of app security can have a serious real-world impact. To illustrate this, Promon showed how it is possible to take full control of a Tesla vehicle, including finding where the car is parked, unlocking the door and enabling its keyless driving functionality10. Crucially, this was all done by attacking and taking control of the Tesla app.”

Today security is typically implemented from the outside in. In most cases this involves defining a virtual perimeter around apps or valuable assets, before bringing in security tools to defend it. Despite the fact that cybercriminals have been finding ways to puncture holes in these perimeters for years, many businesses still believe that an adequate cybersecurity lies in building a better wall.

This is something that research has pointed out. According to Gartner organisations spend more than 20 times as much on protecting the perimeter than on the apps themselves. With the mobile threat landscape constantly evolving, mobile becoming increasingly pervasive in our daily lives and the number of available apps growing rapidly simply protecting the perimeter is no longer sufficient.

The Ubiquity of Mobile.

A growing appetite for mobile apps

Apps are inherently insecure is due purely to the fact that users consume more mobile apps now than ever before. A broadening attack surface Inevitably, growing mobile usage means more businesses are looking to write and deploy their own mobile apps. With this comes a larger attack surface on which cybercriminals can conduct their activities.

Maintaining mobile devices

Ensuring mobile devices are using the latest version of an operating system is much more of a challenge than maintaining a desktop, given that many devices are owned by customer themselves.

RASP involves protecting apps from the inside out, by adding security that can be part of the app’s source code. The protection measures offered by RASP include one or more of the following elements:

• The ability to terminate user sessions.
• The ability to terminate an app without affecting other apps on the server or device, or at least identify a misbehaving or compromised app.
• If an app is compromised, an alert is sent to a management console or directly to the user.
• The ability to inspect application logic flow and data flow.
• The ability to connect to the application runtime processes and environment.

RASP tools support a variety of programming environments, including Java, Objective C and Swift, along with most common development frameworks. Some tools are designed largely for desktop apps, while others can handle apps running across a wider range of desktop and mobile systems.

Benefits of RASP.

One layer of many

A layered approach, which incorporates RASP at the runtime level, provides a holistic framework which grants the best possible protection to apps. Due to the fact, that it operates at the app level, RASP can complement other security layers, rather than compete with them.

Business Benefits:

• Defeats targeted attack.
• Quick to deploy.
• Protects multiple business apps.
• Meets strict compliance requirements.
• Improves fraud detection.

It is clear that mobile presents a range of security challenges for businesses. Hackers are continuing to hone their craft and have a fertile hunting ground on which to search for prey, thanks to the rapid proliferation of apps and mobile devices. To stay ahead of the rapidly evolving threat landscape, RASP technology can be a highly effective way of guarding apps, and therefore your sensitive data and positive reputation. When properly implemented, RASP provides a level of protection that traditional solutions cannot offer, in a way that minimises the impact on pre-existing systems.

Disclaimer: This articles has been published in SecureMAG Volume 11, 2019