TERMS AND DEFINITIONS
Application protection glossary
36 key concepts in Android and iOS security: app protection, attestation, RASP, cryptography, SEO and ASO.
These concise definitions link to guides explaining each concept, its uses and its limits.
- AEAD
- Encryption providing confidentiality, integrity and associated-data authentication.
- Anti-tamper
- Controls that assess changes from an application’s expected integrity.
- App Attest
- Apple’s mechanism for evidence relating to application enrollment and subsequent requests.
- App protection
- Controls addressing mobile code, data, identity and transaction risks.
- App shielding
- A product-dependent scope that may combine code hardening and runtime controls.
- ASO
- Work on store presentation, discoverability and matching an application to the right users.
- Attestation
- Verification of evidence from a trust source in a defined application or key context.
- Certificate pinning
- Restricting expected certificate or public-key trust to selected values.
- DAST
- Security testing of running applications or services through their external behavior.
- DeviceCheck
- An Apple mechanism for maintaining and evaluating selected device state through a service.
- DPoP
- A mechanism binding OAuth token use to proof of possession of a particular key.
- Entitlement
- Information defining an Apple application’s permitted platform capabilities.
- Fail-closed
- Withholding defined access when a required control cannot complete.
- Fail-open
- Allowing defined access to continue when a required control cannot complete.
- False positive
- Legitimate behavior incorrectly classified as risky or invalid.
- HMAC
- Message authentication using a shared secret key.
- Hooking
- Observing or changing the behavior of functions at runtime.
- Idempotency
- Behavior that prevents retries from unnecessarily duplicating the same lasting operation.
- Jailbreak
- A general term for modifications that relax Apple platform restrictions.
- Keychain
- Apple’s system for storing sensitive records with defined access conditions.
- Keystore
- Android’s platform system for managing cryptographic keys and their use conditions.
- MASTG
- OWASP’s technical testing and reference guide for mobile security assessments.
- MASVS
- OWASP’s reference standard for mobile application security requirements.
- Nonce
- A protocol-specific value with requirements such as uniqueness or freshness.
- Obfuscation
- Transformations of names, control flow or representation intended to make code analysis harder.
- PKCE
- A mechanism connecting OAuth authorization-code exchange to the initiating client flow.
- Play Integrity
- Google’s service providing selected platform evidence about Android applications and environments.
- PoC
- A bounded evaluation of whether a real application meets specified requirements.
- RASP
- Runtime application self-protection: assessing signs of interference and responding according to policy.
- Replay
- Reuse of a message or evidence that was valid previously.
- Root
- A condition associated with elevated system privileges in Android environments.
- SAST
- Security analysis of source code and related structures without running the application.
- SBOM
- An inventory of software components and related information.
- Secure Enclave
- Apple’s isolated protection boundary for supported key operations.
- SEO
- Work that helps search systems and users understand web content.
- StrongBox
- A dedicated security option for supported key operations on compatible Android devices.