Security Glossary

Cybersecurity is the practice of protecting networks, applications, systems and data from digital attacks. These attacks may aim to steal sensitive information, disrupt services, or gain unauthorised access. In mobile applications, cybersecurity includes protecting APIs, user authentication, encryption, runtime behaviour, and backend systems. For example, a banking app must prevent account takeover, data interception, and tampering attempts to protect transactions and users from frauds. Effective cybersecurity combines proactive detection, prevention, monitoring, and response strategies. It involves tools like comprehensive security testing, firewalls, encryption, app shielding and runtime protection. Effective cybersecurity protects apps from threats actors (viruses, malware, hackers). Cybersecurity standards and frameworks must be followed strictly to minimise breaches, financial loss, and reputational damage.

Code integrity refers to the application code that has not been changed or tampered with from its original trusted version. Maintaining code integrity is important to make sure that it is secure from malicious code injections, altered code logics, or distribution of modified versions of the application. To verify this, integrity checks use methods like checksums, digital signatures, and runtime validation to ensure the code remains unchanged. In mobile apps, code integrity checks detect repackaged apps, abnormal modifications, or tampering attempts, helping protect users from compromised or malicious versions of the application.

Code injection is a vulnerability where attackers insert malicious code into an application to manipulate its behaviour or gain unauthorised access. The process includes injecting code in the same language as the application. It alters the app logic. Common examples of code injection include SQL injection, operating system command injection, and script injection. Preventing code injection is important because it can give attackers full access to the server. Common methods to avoid code injection include:

• Avoid using functions that execute input as code, such as eval() in PHP or Python.
• Apply strict whitelist validation by allowing only expected data formats.
• Use RASP solution that prevent code injection
• Grant only the minimum necessary permissions to users.

Code hardening is a process of making code difficult to read, making reverse engineering more difficult and tampering. Strengthening application code is important and can be done using techniques like obfuscation, encryption of sensitive logic, anti-debugging, and runtime protection. Unprotected code can be easily analysed and modified by attackers. Code hardening increases the difficulty of understanding and manipulating app logic. Code hardening protects intellectual property, prevents code stealing and reduces the risk of app repackaging. Bugsmirror Shield is an advanced tool for code hardening, encryption, and obfuscation. It encrypts the app code which is impossible to decrypt. It helps in strengthening app binaries and prevents reverse engineering and app repackaging.

Cryptography is a technique of converting readable data (plaintext) into an unreadable format (ciphertext) using mathematical algorithms and keys. It is performed to protect the data, ensuring only authorised people can decrypt it or read it. Common types of cryptography includes: symmetric key cryptography, asymmetric key cryptography, and hash functions. In cybersecurity, cryptography is used for the following:

• Encrypting data to protect data at rest and data in transit.
• Digital signatures and certificates to verify the authenticity of digital documents and identities.
• Protecting web traffic via SSL/TLS.
• Hashing the user's password to prevent unauthorised access.

In the world of cybersecurity, compliance is adherence to legal, regulatory and industry standards that are designed to protect sensitive data and information systems from cyber attacks. There are several compliance requirements that are mandatory for organisations to follow and apply. They are a set of rules and regulations developed to protect from data breaches, make apps trustworthy for users, and provide a roadmap for strengthening security. Failing to comply with the respective compliance, organisations may face cyber attacks and they are levied with fines and legal liabilities. Some common mobile app compliance standards are OWASP MASVS (Mobile Application Security Verification Standard), SEBI CSCRF (Cybersecurity and Cyber Resilience Framework Guideline), RBI DPSC (Digital Payment Security Controls), NPCI UPI Guideline, GDPR (General Data Protection Regulation), HIPAA (Health Insurance Portability and Accountability Act), etc.

CodeLock is Bugsmirror’s mobile-focused automated Static Application Security Testing (SAST) solution designed to identify vulnerabilities in Android and iOS applications without executing the app. It analyses compiled binary files, eliminating the need for source code while protecting intellectual property. CodeLock detects over 50 static code-level threats, including hardcoded secrets, insecure cryptographic implementations, and misconfigurations. It generates detailed, executive as well as developer-friendly reports explaining where bugs exist, why they matter, and how to fix them. CodeLock is especially designed for mobile ecosystems and provides early risk identification with high accuracy, fewer false positives, and smooth integration into safe development workflows.