Threat Model

Threat Model Nedir
Açıklaması şöyle

This is where you sit down and think about your application's modules and components, and do research on which areas would most likely be compromised and how. You map these out, many times in a diagram, and then use that threat model to address them as best as you can in the implementation. Perhaps you model out 10 threats, but decide that only 3 are most likely, and address those 3 in the code or architecture.

Obfuscation
Bu işe başlamadan önce deobfuscation araçlarını ve varlıklarını bilmek gerekir. Açıklaması şöyle

Lastly, know that various obfuscators out there have deobfuscators and "unpackers." One such example is de4dot, which deobfuscates about 20 different C#/.NET obfuscator outputs. So, if your idea of protecting something sensitive is just using a commodity obfuscator, there's a high chance that there is also a deobfuscator or other folks online who are discussing deobfuscating it, and it would be useful for you to research them before you decide to use an obfuscator.

Amaç obfuscation ile tersine mühendislik yapmaya çalışan kişiyi yavaşlatmak. Açıklaması şöyle. Yani kişinin deobfuscation aracında tersine mühendislik yapması 2 saniye sürüyor olsa bile, en azından bu aracı temin etmesi, kurması gibi işlerde yavaşlatmak.

Apply obfuscation if your threat model requires it. With obfuscation, the sky is the limit. The reality is, it is an effective protection mechanism in many cases. I hear people bashing on obfuscation a lot. They say things like

"Obfuscation will never stop a determined attacker because it can always be reversed, the CPU needs to see the code, and so on."

The reality is, as a reverse engineer, if whatever you've done has made cracking into your app take 2-3 weeks instead of an hour (or even 3 hours instead of 5 minutes), I'm only cracking into your app if I really really want something. Most peoples' apps are frankly not that popular or interesting. Sectors which need to take extra measures would include financial, government, video game anti-hacking/anti-cheat, and so on...

Şifreleme
Hangi şifrelemek yönteminin kullanılmasının daha iyi olacağının açıklaması şöyle. Kime karşı koruma sağlamak istiyoruz ? Eğer şifreyi bilen birisinin zorla kaçırılma ihtimali varsa, milyon dolarlık şifreleme işe yaramayabilir.

The strongest possible way to encrypt data is to start with a threat model. What sort of adversary are you trying to protect your data from? What are they willing to do to get it? All reasonable approaches to cryptography start with one. If you start with one, you stand a chance of finding "the strongest" for your particular situation.