Application Security

You cannot eliminate risks, but you can mitigate them.

In today’s increasingly dynamic and threat-prone applications landscape it is not sufficient for application security to survive by picking up the crumbs off the IT budget table.  Both tactical and strategic investments in application security measures are a must for organizations that are looking at effectively managing risks to their applications, particularly customer facing applications.

The situation gets even graver with many enterprises going full steam ahead on their customer-facing and corporate-oriented mobile applications.  As mobile devices get closer and closer to PC functionality, security for mobile and computer applications is imperative.

Most organizations today, as far as application security goes, continue to invest in tactical approaches such as penetration testing and adopting scanning tools which feature at the finale of the development process or during production. Strategic approaches such as security architecture consulting and code-level analysis are not being taken up as they should be.

The reasons for this are twofold, one – such strategic approaches take time to deliver ROI. The second reason and probably the vital is the fact that not many developers are open to changing their existing processes and incorporating steps such as code-level analysis and security architecture consulting throughout the software development life cycle.

One way and probably the best way to work around this is to bring onboard a service provider focused on only testing right from the requirements gathering stage - a test-only vendor who is also responsible for preventive security measures such as threat modeling, secure design, and code-level analysis, throughout the application life cycle, from the requirement phase to production. Organizations should also insist their application suppliers successfully pass through the tollgate of a reputed third party independent verification/validation and certification company.

We like it or not in today’s world organizations need to implement proactive measures, advanced analytics, and ultimately a more ‘risk-mitigate’ approach to application security - internally or through trusted third party vendors who provide such services.