The Mobile App Security Library

Threat modeling identifies and addresses potential security threats in a system, application, or process to help you design secure systems.

Application hardening for mobile apps refers to implementing security measures to protect apps against reverse engineering, tampering, or malware attacks. Using methods such as runtime self-protection, code obfuscation, and white-box cryptography, application hardening protects your app against some of the most common types of cyberattacks. However, application hardening is not a replacement for security measures integrated into app development at outset.

A false positive occurs when a security system incorrectly identifies legitimate, non-malicious activity as a threat. As a result, it generates an alert or blocks the action. False positives are common in tools like antivirus software, intrusion detection systems (IDS), and email filters, where overly sensitive or misconfigured settings can flag normal behavior and files as suspicious.

Certificate pinning is a security technique that increases secure communication over the TLS (transport layer security) protocol, like HTTPS. It ties a chosen TLS certificate or public key exclusively to the API server, allowing the application to reliably confirm the server's identity each time it connects. During interactions, the server presents a digital certificate to prove its identity and secures the encryption of data sent through APIs between the client and server. By matching the server’s shown certificate against a predetermined or "pinned" certificate within the app, certificate pinning ensures an additional layer of security, preventing man-in-the-middle (MITM) attacks and ensuring server communication integrity.