Reverse Engineering
What is Reverse Engineering?
The process of analyzing software, hardware, or protocols to understand their design and functionality, used in security research and malware analysis.
Terms that appear alongside reverse engineering
Each of these is named in at least one of the same controls as reverse engineering. The number is how many controls name both.
- nist 3 shared controls
- cybersecurity 3 shared controls
- compliance 2 shared controls
- policy 2 shared controls
- integrity 2 shared controls
- resilience 2 shared controls
- incident response 2 shared controls
- responsible ai 2 shared controls
Frameworks that govern reverse engineering
What the standards actually require on reverse engineering
Requirements naming reverse engineering across 6 standards, quoted from the control text.
Per OWASP MASVS v2 MASVS-RESILIENCE: resilience against reverse engineering + tampering. Requirements include (a) understand resilience is defence in depth + not replacement for server-side controls + (b) implement anti-debugging + anti-tampering + anti-hookin...
OWASPMASVS-7 · MASVS-RESILIENCE: Resilience Against Reverse Engineering →Referenced by 14.1.4. Measures to consider for mobile applications: avoid storing or caching data in the app and keep data in a protected, trusted area of the device; protect private cryptographic keys;
monetary-authority-of-singapore-technology-risk-management-guidelines::C · Annex C Mobile Application Security →Build the conceptual, logical and physical models, forward and reverse engineering as needed, identifying entities, relationships, attributes and keys and applying naming standards.
dama-dmbok2-data-management-body-of-knowledge-2nd-edition::DMD.2.2 · DMD.2.2 Build the data model →Where data from a previous application falls short of the new safety objectives (for example developed at a lower level), the document's objectives are met while using the previous data;
do-254-ed-80-design-assurance-guidance-for-airborne-electronic-hardware::11.1.4 · 11.1.4 Upgrading a design baseline →Critical security parameters such as usernames and passwords, API keys or private keys are not hard-coded in the device software source code, since reverse engineering finds them readily and obfuscation is easily broken.
etsi-en-303-645::Provision 5.4-3 · No hard-coded critical security parameters in source code →Because stakeholders view the system at different levels, requirements are also defined and documented below the system of interest by allocating system requirements to system elements during architecture definition, iterating with architecture and design to s...
iso-iec-ieee-29148-2018-systems-and-software-engineering-requirements-engineering::5.3.2 · 5.3.2 Iteration, recursion and derived requirements →Questions people ask about reverse engineering
What is Reverse Engineering?
Why is Reverse Engineering important for compliance?
Which compliance frameworks address Reverse Engineering?
Where can I learn more about Reverse Engineering?
See how Reverse Engineering applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.