Mobile Application Security Core (MASC)
Overview
Mobile Application Security Core (MASC) protects mobile banking, payment and enterprise apps against tampering, reverse engineering and runtime attack, combining application encryption, secret protection and runtime self-protection. Unsung supplies and implements MASC as a Cryptomathic Bronze Partner, working with UK financial services and enterprise organisations whose apps handle sensitive transactions, credentials or regulated data.
Buying MASC through Unsung
We provide independent advice on the most suitable licensing model and product mix, so you get value for money from Cryptomathic.
You also benefit from:
- Fit with your development and back-end estate. We help your teams embed MASC into existing build pipelines and connect it to your server-side PKI and authentication services.
- Specialist support, with first-line triage from our PKI specialists and escalation to Cryptomathic when required.
- Partner pricing through our Cryptomathic partnership.
The Challenge
Apps that handle payments, authentication or sensitive data run on devices the organisation does not control. Unlike server-side software, they can be decompiled, have embedded secrets extracted, have their logic modified or have data intercepted at runtime.
Native mobile platform security provides a baseline, but regulated organisations, particularly in banking and payments, need stronger assurance. They must show that their apps resist tampering, protect embedded cryptographic material and recognise hostile environments. Without that protection, they face credential theft, transaction manipulation and regulatory exposure.
What It Does
MASC takes a layered approach. Application encryption protects the binary against static analysis and reverse engineering. Configuration and secret protection secures the keys, certificates and configuration data the app depends on. Runtime Application Self-Protection (RASP) monitors the execution environment for tampering, debugging, rooting and other hostile conditions, so the app can respond in line with defined security policy.
Capabilities are delivered through SDKs that developers embed into existing workflows. MASC is transparent to end users and helps the organisation keep its app intact from build through to execution.
How Unsung Helps
We assess your mobile security requirements and implement MASC as part of a wider architecture that includes server-side PKI and authentication. That means working with your developers on SDK integration, aligning MASC with how keys and certificates are issued and managed on the back end, and supporting the solution in service.
MASC protects the app itself. Where you also need strong user authentication or transaction signing, Cryptomathic Authenticator or Cryptomathic Signer may complement or suit your needs better, and for mobile access backed by PKI credentials, MyID Derived Credentials is another option. As we supply all of these, we can recommend the right combination for your service.
Related Unsung Services
- PKI Consultancy: Advice on mobile security architecture and integration with enterprise PKI.
- PKI Design & Build: Design and delivery of authentication and signing infrastructure for mobile services.
- Certificate Lifecycle Management: Managing the certificates that mobile apps and their back-end services depend on.
