App Optimization: Mobile App Security Doesn’t Have to Impact Performance

Many Android developers view application security as a barrier to development and a hindrance to app performance. However, effective mobile app security doesn’t have to impact performance.

We’ve already discussed how implementing a secure software development lifecycle can help improve both the security posture and development velocity of a mobile app. Similarly, Android apps should be both optimized and secure. With the right tool, it doesn’t have to be a tradeoff.

In this blog, we’ll discuss why both strong app performance and security are important for app publishers, the key tactics for improving app performance, and how Guardsquare can enable both.

The Importance of Strong App Performance and Security

Mobile app performance is crucial for providing a strong user experience that keeps customers coming back. If an app takes too long to download or it’s too slow during runtime, users may stop using the app.

Similarly, poor mobile app security can also impact the app publisher’s revenue and brand reputation. If an app has inadequate security measures, the app is at risk of experiencing a security incident or security breach.

• A security incident is any violation of a company’s security policies, whether it's bypassing access controls, modifying app behavior, or cheating in the gaming world. The problem is that security incidents usually lead to a lack of consumer trust resulting in fewer customers and less revenue. There could also be regulatory penalties depending on the industry and a negative long-term impact on brand reputation.
• A security breach is the unauthorized access of data. When malicious actors gain access to privileged data, they can use this data for their own financial gain or share it with others. That means an app publisher could face the leaking of sensitive information, intellectual property (IP) theft, and even a loss of competitive advantage.

Understanding the Different Elements of App Performance

There are two primary steps for improving application performance: shrinking the app size and optimizing the application code.

App shrinking involves removing unused code and resources, one technique for this is called tree shaking. By safely eliminating unnecessary classes, fields, methods, and attributes within a mobile app’s code and dependencies, it’s possible to shrink the app size, sometimes by up to 90%. This can improve download speeds from the app store and encourage users with limited Internet bandwidth or data plans to download the app.

Code optimization means replacing code with new code that is less verbose or complex, one such technique is using peephole optimizations. By replacing individual instructions with simpler equivalents and using other, more advanced techniques, it is sometimes possible to make an app up to 20% faster. This enhanced app speed can greatly improve the mobile app user experience.

Together these two techniques can make a mobile app as small and as fast as possible. App optimization may have a direct, positive impact on the user's experience, but optimization may be meaningless if the app doesn't have the right level of security.

Guardsquare: Mobile App Security and Performance Optimization Together

We built DexGuard using our experience developing ProGuard, a state-of-the-art, open source solution for shrinking and optimizing Java bytecode. DexGuard not only optimizes and shrinks your app’s bytecode, but also does the same for its resources, assets, dependencies, native libraries, and more. These comprehensive performance optimization capabilities ensure your app is lightweight and fast.

DexGuard also implements application hardening measures to protect your app from both static and dynamic attacks, which prevent negative business outcomes like financial costs and reputational damages. DexGuard can integrate directly into your existing development process, and uses multi-layered obfuscation techniques to prevent reverse engineering attempts.

In addition, DexGuard protects your app after it’s released to the public. Runtime application self-protection (RASP) identifies suspicious behavior and responds in a pre-programmed manner to prevent live tampering attempts. You can also use ThreatCast to monitor your app in real-time and continuously improve your mobile app security posture.

Contact us to learn more about implementing comprehensive app protections while also optimizing your Android app’s performance.