Best way to secure authenticator app itself?

The best way is to have it in an offline setting.