Author: Michelle Pruitt

Categories
101

PreEmptive – JSDefender 101

PreEmptive - JSDefender 101
Reading Time: 3 minutes

Did you know JavaScript is used by 13.8 million developers worldwide? This means that 53% of developers either use or have used JavaScript at some point throughout their career. Making this the most popular coding language in web and cloud development. As programming languages are an essential tool, they are a critical security & quality priority that all developers are focused on. And since programming languages are also opportunities for attack, it is essential to implement obfuscation protection as preventative measures to protect your work from being copied, attacked or leveraged to cause further damage.

Just like in our previous 101’s for Dofuscator for .NET, in this article we explain how JSDefender for JavaScript can help secure and protect your work using obfuscation techniques with additional layered security.

What is the Product used for?

Similar to Dotfuscator for .NET, JSDefender is primarily used to protect and harden your applications that are composed of JavaScript. It encrypts your projects through a layered approach. Javascript is commonly used and as the risks of hacking continue to expand, it’s more proficient to implement code security at the early stages of development. In other words, by not using some sort of cybersecurity, it is like leaving your phone on the table and unlocked for the world to see what you’re up to. But, on this scale it is not just your data that is exposed, but the entirety of your users data and product IP.

How does JSDefender work?

JavaScript apps are typically distributed in source form, meaning your code can easily be visible to anyone with access to a browser. If a project isn’t protected, a hacker can conveniently use a debugger (that is built in their browser) along with other sophisticated tools to analyze your code for vulnerabilities – which highlights the path of hijacking your project. JSDefender uses a layered approach that is applied to the binary code using obfuscation, encryption, tamper detection, domain locks, debugger removal, function recording and more, basically scrambling the source code making this very difficult for the average hacker.

When should you use JSDefender?

Anyone who is developing an IoT (internet of things), mobile/desktop application, SaaS (software as a service), or any system software program using JavaScript as your language of development, should be using JSDefender. It’s widely known that investing in DevSecOps (development security operations) is of increasing importance for not only companies, but freelancers as well. There is not an industry that has not been affected by a data breach, and any company who uses or has built a website should know the importance of investing in DevSecOps. We did a case study of GlobalMed who used JSDefender in order to protect their advanced virtual health platform and now they have become the world’s number one telemedicine company!

Where does JSDefender work?

JSDefender is injected directly into your source code. You can specify your own configuration file or use command line options to set up protection attributes. It takes minutes to set up and seconds to begin securing your source file. We have developed a demo so that you can visually see how this works in real time!

JSDefender demo

Why should you use PreEmptive JSDefender?

By using JSDefender you are taking action against any type of attacks to your JavaScript projects by obscuring and managing your vulnerabilities directly in your code within a matter of seconds. We know time is of the essence in development, but implementing security in the beginning of the SDLC saves you time, money and protects your reputation in the long-run. Waiting until the end to scan for vulnerabilities will only prolong the development cycle and you will end up running into issues that could have been avoided if security was part of the process early on. JavaScript is here to stay and as the world of tech advances, so will hackers. So if you feel that your DevSecOps isn’t up to par or stressed about being hacked, download a free trial by visiting our product page and start protecting your intellectual property today!

For more information on how to get started or need further help, we encourage you to use our resources, found in our navigation bar. We hope this blog has guided you to better understand JSDefender for JavaScript. Be on the lookout for our upcoming 101’s! 

Categories
Risk Management

Reasons to Invest in DevSecOps

Reasons to Invest in DevSecOps
Reading Time: 3 minutes

As you know by now, devsecops are commonly talked about by experts across the board, now more than ever as new companies, freelancers and other entities merge into the tech space and increase their reliance on IOT solutions. With all the cyber attacks that have been increasing every 6 months, development security operations have pivoted in the forefront of company investments. That is why it is crucial to not skip out or budget in security measures for your fiscal year. But why should you invest in the first place?

#3: Automation Speeds up Development Process

Working on a large project can be gruesome, but not having it secured is like leaving your wallet on the table to be snatched up. We understand that time is a key factor in the development process, so it should be a no-brainer for companies or developers to seek out a devsecop tool that works in their favor without jeopardizing function. But how can this be achieved? Automation of course! Shift your security to automated testing speeds up your development process providing quicker response time to help pinpoint and solve problems. Just like DevTools, DevSecOps are very similar. They both need automation and by shifting security measures to this, ensures best practices with your IT team.

 #2: Replaces the one-off Security Assessments

Usually security is probably at the last stages of your development cycle and while other companies only look at this quarterly, which only sets you up for a breach. DevSecOps changes this dynamic by securing your projects from the start. It replaces that one-time snapshot of your code by consistently looking at it. And since Devops is driven by code, your security should follow suit, security can easily be integrated in your CI/CD pipeline. Shifting your best practices by investing in DevSecOps takes your team from examining problems at the end to testing each week. If you know where the weak spots are then you easily fix and repeat this process throughout only making your project rock solid!

#1: Breaking Down Organizational Silos

Silos should be a thing of the past, but can still be found in today’s organizations. There should be no reason that security measures be isolated to only one department, because as you may know, each department is used to handling situations in their own way due to urgent matters. The common corporate “red tape” is consistently boroughed through, so in order for DevSecOps to truly work, everyone and every department need to be following the same measures. Development teams should align and agree on what type of measurements to use or have a set of objects implemented throughout, and not only isolated in one department. By having everyone on the same page your security will be one force to be reckoned with and you won’t have to worry about becoming another victim of cyber crime. 

We encourage everyone to read our case studies to find out how other companies found success with PreEmptive in their DevSecOps. PreEmptive has been blazing the trail in devsecops division for quite some time. Not only do we have a long company history, but our products are used by Fortune 500 companies worldwide. We hope this blog has helped you solidify the decision to invest in your DevSecOps process, but if you’re not sold try us with a FREE Trial!

Categories
Risk Management

How to Avoid Breaches

Reading Time: 4 minutes

Did you know that your company’s finances, reputation and intellectual property is at stake when you’re not protected even during the development phase? Desktop (client) applications perform many critical business functions and when not protected, they are susceptible to piracy, tampering, vulnerability probing, data, and IP breaches. 

We cannot stress enough on the importance of investing in desktop application protection. Research shows that the average application received over 13,000 attacks monthly even after deployment! The same goes for app development, all of those endless nights of debugging, troubleshooting can be hacked within seconds and your sweat equity is sold to the highest bidder. Hackers have no remorse and can readily run a few lines of code to probe or gain access to your project(s). While these criminal activities are not news, cyber hacking has evolved and will continue to do so as DevSecOps also progresses. 

In order to get ahead, you must know the facts about a hacker’s business model, industry risks and the proactive measures in order to prevent breaches.

What is the Hacker’s Business Model?

If you guessed “money” as the ultimate goal of the hackers business model – then you’re right! What else would be the motivation?

In terms of “increasing revenue,” data is equivalent to currency, the more data they obtain, the more money they can get, but this is a small portion of a much larger scheme. One large attack won’t suffice, they tend to automate their tactics or use additional help. For example, a master hacker can create a clever downloadable kit for other hackers to use on a specific site, these are called “proxy” hackers, which technically multiplies the solo hacker’s work. But let’s not underestimate the master hacker, these clever kits have barriers – they allow and grant access to a single proxy hacker to store data on a database in the cloud, all while having adjacent blocking mechanisms to other proxy hackers. Even those proxy hackers cannot see each other’s data, the master hacker has the ultimate backdoor key to the cloud database. 

Time is money, and in the world of hacking “cutting cost” is essential. Let’s not be naive, there are kits for just about every kind of attack. Instead of inventing the wheel or doubling up on the work, hackers will use what others have already built. Another cost-cutting example is to utilize proxy servers. This allows attackers to temporarily store the data that is being retrieved. Last but not least, hackers love to use Remote Desktop Services (RDP) sessions or isolate a central processing unit (CPU) to maximize their attack. 

To stay on top of your security game, the best thing to do is educate yourself and your team about the behavior of hackers. Study their business model, understanding this will allow your IT department to focus their controls on the problem, rather than on the symptom. Educate your teams on how they attack. If you understand their methods, you can be proactive, applying security throughout the SDLC to give your team the power to prevent risk.

Knowing Industry Risks

Each industry has specific risks. For example; software vendors, financial service providers, telecommunications companies, industrial manufacturers and other businesses rely on applications to generate revenue, assure business continuity and contain unique intellectual property. Businesses of all types have risks associated with their divisions and recognizing all of them is a full time job. But, we can’t all afford to hire security researchers, proactive approaches are based on recognizing the key challenges and building security around them. 

If your company’s security systems aren’t up to par, then the risks of a breach are far greater, not discovering a breach costs you money, for every week a risk is in a deployed app your customer data is accessible, IP available and runtime performance at risk. 

The average annualized cost for cybercrime in the financial services industry is approximately $20 Million with the average for all industries being $13 Million. Each year technology changes and with that so do unforeseen challenges, for instance, prior to pandemic industry risks were far less than they are today with remote working. Now that sensitive data can be accessed anywhere at any given time, attacks have tripled in the past three years thus shifting each industry’s security standards. If you know your industry’s risk, you know what to look out for.

Investing in In-App Security

Allocations for security tools are crucial for all types of business when developing for their fiscal budget. According to Cisco, 50% of large enterprises (with over 10,000 employees) are spending $1 million or more annually on security, with 43% spending $250,000 to $999,999, and just 7% spending under $250,000. Larger corporations have the budgets, but it is the smaller businesses that tend to overlook or not invest in security. By not investing in any type of cyber security, this exposes each business to the core. Reputation, loss of finance and sensitive data are just a few examples of what a company will face during a breach. It is better to be safe than sorry.

PreEmptive layered approach using obfuscation, encryption, shielding, and tamper proofing, makes it very difficult for a hacker to read your source code. Our products require no changes to your source code, easily integrate with your build process, and provide passive and active protection customized to your business’ needs. For more information on how to get started, download our free trial or need further help, we encourage you to use our resources, found in our navigation bar.

Categories
101

Dotfuscator 101

Dotfuscator 101
Reading Time: 4 minutes

In this blog we will dive into Dotfuscator  as part of our 101 series – we walk you through what Dofuscator for .NET does and how this can help protect your projects. 

For those of you who are in the industry and know how this product protects your code, we appreciate the loyalty! If you are not tech savvy, but want to know a little bit more about this product, here’s our summary:

What is Dotfuscator for .NET?

Dotfuscator – by definition is a multi-functional tool that combines obfuscation, optimization while shrinking your source code, on .NET, Xamarin and Windows Platform Apps. Basically this jumbles, encrypts your code, hardening it to prevent theft. 

How does Dotfuscator work?

PreEmptive Dotfuscator for .Net provides many layers of protection for .NET users with multiple forms of obfuscation. We like to describe this as constructing the perfect sandwich.

  • First we start with the bread, in this case we will call it Renaming. Renaming obfuscation alters the variables and methods making it difficult to read or scan over to gain access to the certain parts of your source code. However, we go a little further by making things extra difficult for the typical hacker by utilizing Overload Induction™. This renames as many methods as possible to the same name instead of changing one variable one by one. To say this least – this is what makes the “bread” harden at surface level.
  • Then add the veggies: lettuce (Control Flow) and tomato (String Encryption). Control Flow uses advanced obfuscation by falsifying conditional statements. Basically it destroys the code patterns that decompilers use to recreate source code resulting in spaghetti logic to confuse anyone who tries to crack the code. Adding the tomato to this (String Encryption), hides all the strings that are present in the user’s assembly. To better explain, the typical hacker will locate string references inside the binary. Usually if the application is time sensitive, a message will pop up when time has expired – this is exactly what hackers search for inside the decompiled output indicating that they are VERY close to stealing your algorithm. Dotfuscator directly addresses this issue by allowing the user to encrypt strings in the most vulnerable part of the source code. 
  • Now comes the choice of meat (Watermarking, Pruning, Linking-Assembly Merging). Watermarking helps track unauthorized copies of the user’s project by embedding copyright information directly into .NET applications without jeopardizing runtime behavior. Pruning takes the work out for you by removing unused types, methods, fields, debugging information and non-essential metadata from a MSIL file all while processing. Dotfuscator Linking-Assembly Merger combines multiple input assemblies into one or more output assemblies – meaning it shrinks your application down alongside pruning and renaming. 
  • Next is the cheese (Tamper Detection & Defense). Dotfuscator injects code that verifies your application’s integrity during runtime and if it detects tampering, it will shut down the application, invoking random crashes. Now that’s an excellent choice of cheese! 
  • Last but not least are the condiments: mayo (Debug Detection) and mustard (Defense Using Checks). These two are prebuilt into Dotfuscator and can be injected into the .NET apps. This allows your app to detect any unauthorized uses such as debugging or tampering of any sort. Don’t be fooled, checks can do more than just the average scanning, they can react too, for example – exiting the app when tampering is found. 
  • For those who like a little extra to the sandwich, (Shelf Life) is the pickle! Shelf Life is an inventory management function that allows you to embed an expiration date, de-activation, and notification logic to your code! Now this is what we call the ultimate sandwich! 

When should you use Dotfuscator?

Whether you’re a start-up company, freelancer or an organization developing projects using .NET software, you should be using this in the development process – preferably in the beginning stages even after launches. Data breaches are no longer part of the “new normal” they are part of everyday scenarios. If you don’t protect your code from the beginning…you will likely become another data breach statistic.

Where does Dotfuscator work?

Dotfuscator is injected directly into your source code, providing a multi-layered approach by way of in-app hardening; assessing and securing where your code is vulnerable.  

Why should you use PreEmptive Dotfuscator?

PreEmptive Dotfuscator has paved the way in In-App security since 2003, that’s 19 years in the biz! Our clients range from small to large enterprises including many Fortune 500 companies of different industries from medical to government agencies. But if you still need a little more convincing, check out our client list here! 

For more information on how to get started, download our free trial or need further help, we encourage you to use our resources, found in our navigation bar. We hope this blog has helped you better understand Dotfuscator for .NET. We look forward to our next 101!

Categories
101

Top 3 Reasons to Use PreEmptive

Top 3 Reasons to Use PreEmptive
Reading Time: 3 minutes

Cyber attacks are part of our everyday discussions and most likely will continue to be present throughout the next 12-18 months. With the rise in nation state attacks, and consistent expansion of IOT tools developers have to stay focused on the prescience of cyber threats. For those who followed our #DataPrivacyWeek on our social platforms, we explained that our personal lives are very much intertwined with our work lives, with many folks working remotely, we are more likely to be part of those data breaches we read in the news, as a side effect of network security risks. In this article we will dive into the primary reasons your team can benefit from PreEmptive to protect your applications. 

While we were focused on supply chain attacks, ransomware threats, we overlooked another but equally prominent risk – mobile app breaches. There were over 200 BILLION mobile application downloads in 2021 and that number will most likely increase as we progress through 2022. This means, if you’re a programmer developing an app or creating a program that consists of custom code, securing your work is more important than ever. Here are the top 3 reasons why you should use PreEmptive to add a security layer to your applications:

Reason 3: Protecting Your Hard Work

We understand the countless hours that go into coding, whether that was spent on debugging, creating or troubleshooting your code’s infrastructure, it takes hard work. Many developers have projects that have been in the works for lengths at a time and have firm deadlines to meet. So when a project is complete it feels like gold! We tend to concentrate on completing our projects and ensuring that functionality/usability is up to standard. But, security is often an afterthought. PreEmptive In-App security features have been helping programmers prevent, detect, and respond to attacks without breaking or slowing down your applications – giving you a peace of mind throughout development. Sure, we all want to complete our projects on time or earlier than expected, but if we treat our projects like we treat our phones by putting a lock on it, then that finish line will look even sweeter. 

Reason 2: Knowing the Functionality of Your Security

Data breaches are a hot topic, so searching for the right security platform has become even more of a priority. One of the factors when searching for the right security toolset – how does it actually work? PreEmptive has a layered approach when it comes to protecting your data. Think of it as building your perfect sandwich starting with the bread (obfuscation), adding the meat (renaming code), then the veggies – lettuce (string encryption), tomato (control flow) and more, topping it off with the condiments (active runtime checks) that monitors tampering, debugs, and more. Now that you know what’s in the perfect “security sandwich,” it’s imperative that you continue to test and secure after each build. This will allow you to have the confidence in your security application.

Reason 1: Becoming another Data Breach Statistic

Every month there is another data breach that is brought to our attention. Which makes you really think, are you choosing the right security platform? How do you know this platform is the right one? Assessing the needs of your company/organization or projects is the first step, next researching security options. Some promise to be “the leading” security platform or the “number one,” but PreEmptive has been in the biz since 1996. That’s over 20 years of securing your applications! Not only do we have the experience, we have hundreds of fortune 500 companies who use PreEmptive, Charles Schwab, FedEx, Census Bureau, Microsoft to name a few. If these companies trust our software, we guarantee that by using us, you won’t become another data breach victim.

In case you still need more information, we encourage everyone to read our case studies to find out how other companies found success in protecting their companies with PreEmptive. We hope this blog has eased your worries, but if you’re not sold try us with a FREE Trial! 

Categories
101

PreEmptive 101

PreEmptive 101
Reading Time: 3 minutes

In this blog we’ve established a 101 – of all things PreEmptive. Our goal is to help you comprehensively understand PreEmptive and our products in basic terms. This is a great piece of content to share with your team, decision makers or that pesky finance department that won’t give you extra budget for security tools.

For those of you who are in the industry and know what we offer, we appreciate the loyalty! If you are new to the industry and are not tech savvy, but want to know a little bit more about PreEmptive, check out our 5 W’s:

Who is PreEmptive?

PreEmptive is an Idera INC software company. We have been obfuscating and protecting applications since 1996, starting with DashO for Java then expanding over the last 20 years to our full range of solutions that you see today! Our core values are: to help organizations make their applications more resilient to hacking and tampering –  to protect intellectual property, to secure sensitive data, and enhance revenue. In other words, PreEmptive is the first line of defense for your code!

What is PreEmptive?

PreEmptive is a software security solution that helps you protect and secure your apps intelligently through a layered approach. Our multi-faeceted approach is applied to the binary code to provide: obfuscation, encryption, root detection, shielding and tamper detection with the end goal of making life difficult for hackers & bots. Let’s add some definitions, what is obfuscation? Obfuscation means making something unclear or obscure – it’s like a frosted window, it obscures your vision but does not prevent functionality. With code obfuscation the goal is to conceal the underlying code that enables the application to function, while ensuring effective functionality of the application 

How is this achieved? Our layered application hardening and shielding is directly infused into your .NET, Java, Android, JavaScript and iOS applications. Which means, we do not require changes to your end user’s computer/device or network to stay fully protected– the solution does the dirty work for you, securing the app against any vulnerabilities in your projects and jumbles up the code so that hackers can’t reverse engineer your proprietary information!

  • PreEmptive not only “scrambles” your source code, but also has the right mix of protection, response and security reporting features, allowing the user to better protect their projects and defending against the ever-evolving data, IP theft, fraud, brand damage and drastic revenue loss. 
  • PreEmptive offers 4 different types of protection: Dotfuscator, DashO, JSDefender, and PreEmptive Protection for iOS. Here’s the key differences:
    • Dotfuscator provides many layers of protection for .NET users with multiple forms of obfuscation (renaming, string encryption, watermarking, active runtime checks (tamper, debug, root, and more).
    • DashO is a security plugin for Android and Java users providing layers of protection by obfuscation (renaming, string encryption, resource encryption, and more).
    • JSDefender is for teams that use Javascript, securing their applications through in-app protection and code obfuscation. This tool helps teams to prevent code from being easily visible to anyone with access to a browser.
    • PreEmptive Protection (iOS) protects all Objective-C iOS applications, reducing the risk of piracy, intellectual property theft and tampering. (Don’t worry, if you’re feeling lost, we will dive into more in depth on each product in our upcoming blogs)

When should you use PreEmptive?

If you’re a start-up company that has blossomed overnight, a freelancer with multiple clients, or a large corporation who needs to enhance their security program, that’s when PreEmptive should come into play. With fair pricing based on your project needs, PreEmptive can be applicable for many organizations.. When writing any source code without protection, you are susceptible to damage and theft, which has long term financial implications. By using any of the PreEmptive products, your team will feel at ease instantaneously, knowing your code is secure even after deployment!

Where does this work?

PreEmptive is injected into your source code, but our operational playbook includes a bottom-up evaluation of security risks, vulnerability mitigation techniques, and post deployment protection to further reduce exposure.

Why should you use PreEmptive?

PreEmptive not only offers different packages based on your needs, but it has been the leading security system for over 17 years! We test, obscure and manage your vulnerabilities directly in your code, so if you feel worried about hackers or stressed about how secure your projects are, check out your options by visiting our main page!

For more information on how to get started or need further help, we encourage you to use our resources, found in our navigation bar. We hope this blog has guided you to understand what it is we do. Be on the lookout for our upcoming 101’s!