ngrok unveiled its JavaScript and Python SDKs, enabling developers to programmatically serve their applications and manage traffic by embedding ingress with a single line of code.
As the volume, development velocity, and variety of applications and their attack vectors skyrocket, it's time to rethink how we use application hardening. Application hardening, also known as "application shielding" and "in-app protection," protects live applications from reverse engineering and tampering.
Application hardening isn't just for mobile applications anymore but is emerging as a standard way of protecting desktop and web applications across industries and for a good reason. Bringing application hardening into a comprehensive DevSecOps strategy will help enterprises overcome secure coding skills gaps and better enable developer teams to deliver higher quality applications faster to meet the demands of today's environment.
By 2025, IDC predicts that 750 million discrete applications will be released worldwide, up from roughly 195 million in 2021 (The Need for Application Hardening as Part of a Holistic DevSecOps Strategy, May 2023). With more applications being accessed from the growing variety of devices and platforms, the attack surface continues to expand. At the same time, cybercriminals keep finding new ways to exploit vulnerabilities, even in securely coded applications via reverse engineering and tampering techniques.
Unsurprisingly, application development velocity keeps increasing, given the popularity of DevOps practices and innovative developer tools powered by automation and AI to speed up dev cycles. IDC expects 70% of large organizations will have the means to release daily code in production by 2025, up from a meager 5% in 2021.
Now companies are integrating DevSecOps technologies with DevOps processes to make security best practices part of the developer's responsibilities. In reality, many developers need more secure coding experience and help to keep up with the shifting threat landscape. Application hardening helps fill these gaps.
Source: IDC, 2023
The following are benefits of application hardening as part of DevSecOps
Improved build-time security posture without burdening developers
Code obfuscation is the most common type of build-time application hardening. It is the process of making code difficult for humans or machines to understand while retaining the integrity and behavior of the application. This process can be automated so more secure applications are released without requiring developers to be security experts. The best obfuscation solutions are regularly updating and releasing new techniques to prevent deobfuscation and reverse engineering.
Visibility into potential attacks of applications in production
Application tampering is the unsanctioned use of an application in a way not intended or authorized by the organization. Tampering happens after an application is released, and unless production monitoring is in place, the organization cannot detect it. Tampering is a growing problem that has led to data breaches, financial and reputational losses, and legal liabilities.
Tampering detection uncovers application and user behavior that signals an application is being messed with. For instance, a threat actor could use a debugger to reverse engineer an application for malicious intent. Device fingerprinting can provide insight into how a user connects to an application to understand behavior better. When alerted to tampering, enterprises receive detailed visibility into information such as the device, operating system, browser, IP address, and geographic location.
Real-time mitigation of attacks from known and unknown threats
While Web application firewalls (WAF) are used to protect Internet-based applications, they analyze the traffic to and from an application but are blind to data within applications. According to Kaspersky, public-facing web apps are the leading attack vector cybercriminals use to penetrate an organization's perimeter.
Application hardening should be integrated into DevOps workflows. Enterprises that take this approach can ensure that nonhardened applications are not released without security protections — for example, through coordination of release orchestration with an Open Policy Agent (OPA).
Application hardening also needs to encompass application monitoring and runtime application self-protection (RASP), which enables applications to detect tampering and automatically respond if tampering is detected. RASP security offers real-time threat detection by looking at both the application and analyzing the context of events causing the current behavior of the application. With this visibility into an application's logic and data flow, RASP can trigger automatic, customizable actions in response to unexpected behavior, offering greater attack protection of applications in production.
When considering an application hardening solution, enterprises should identify solutions that incorporate tamper detections, code obfuscations, and RASP with customizable event responses. Additionally, any solution should integrate with DevOps and DevSecOps workflows and allow for proper governance and compliance checks. Finally, solutions that are open-architecture and allow for heterogeneous toolsets will provide the most flexibility as they are incorporated into workflows.
Industry News
Data Theorem introduced API Attack Path Visualization capabilities for the protection of APIs and the software supply chain.
Security Journey announced support for WCAG, SCIM and continued compliance with SOC2 Type 2, which are leading industry standards.
Vercel announced a new suite of features for its Developer Experience (DX) Platform, made for enterprise teams with large codebases.
Atlassian Corporation has completed the acquisition of Loom, a video messaging platform that helps users communicate through instantly shareable videos.
Orca Security announced that the Orca Cloud Security Platform has achieved the Amazon Web Services (AWS) Built-in Competency.
Parasoft, a global leader in automated software testing solutions, today announced complete support for MISRA C++ 2023 with the upcoming release of Parasoft C/C++test 2023.2.
Solo.io achieved the Amazon Elastic Kubernetes Service (Amazon EKS) Ready designation from Amazon Web Services (AWS).
CircleCI implemented a gen2 GPU resource class, leveraging Amazon Elastic Compute Cloud (Amazon EC2) G5 instances, offering the latest generation of NVIDIA GPUs and new images tailored for artificial intelligence/machine learning (AI/ML) workflows.
XM Cyber announced new capabilities that provide complete and continuous visibility into risks and vulnerabilities in Kubernetes environments.
PerfectScale has achieved the Amazon Elastic Kubernetes Service (Amazon EKS) Ready designation from Amazon Web Services (AWS).
BMC announced two new product innovations, BMC AMI DevX Code Insights and BMC AMI zAdviser Enterprise.
Rafay Systems announced the availability of the Rafay Cloud Automation Platform — the evolution of its Kubernetes Operations Platform — to enable platform teams to deliver automation and self-service capabilities to developers, data scientists and other cloud users.
Bitrise is integrating with Amazon Web Services (AWS) to provide compliance-conscious companies with greater access to CI/CD capabilities for mobile app development.
Armory announced a new unified declarative deployment capability for AWS Lambda.