Enhancing the security of your applications

Issue 7 2021 Cyber Security

Is software part of how you are delivering value to your customers? But how is your organisation innovating through software?

Software adds value, but it also introduces risk. Let’s take the example of Equifax, described as a data ‘mega-breach’ that exposed the personal information of 147 million people and was caused by an application vulnerability that cost the company more than US$2 billion, with about US$700 million in settlements alone. The company went on to become the subject of US congressional hearings as well as several investigations.

The interesting thing about this is that they had application security tools in place, so what went wrong?

Veracode has partnered with companies to deliver application security programmes since 2006 and here are the most common reasons the company sees why secure software initiatives fail.

No remediation

Firstly, AppSec programmes fail when developers are not engaged or empowered to fix vulnerabilities and security teams are only incentivised to find weaknesses, but not to remediate them. Too often, security teams dictate rather than partner with development teams and have unrealistic expectations. The mountain of technical debt can be enormous and developers are often not trained to fix potential liabilities. The net result is a toxic relationship between security and development.

Complex tools

Secondly, tooling is difficult to manage and many solutions require weeks, if not months, of deployment before they are able to conduct the first scan. Then come the operational headaches, plus scalability and high availability issues. Maintaining solutions can be challenging, leaving businesses months behind coverage for the language and framework versions their development teams are using.

To busy putting out fires

Thirdly, security teams are often busy running scans and keeping infrastructure up to date that they simply don’t have time to focus on the programme itself. They’re in a vicious cycle and don’t have the headcount to deliver an holistic AppSec programme that gets stakeholders aligned on the vision and roadmap for it. Reporting the correct metrics to C-Level executives on successes is difficult and hence programmes continue to be underfunded.

Veracode’s approach to application security addresses these three areas:

Veracode provides a unified solution for all major application analysis types, languages, and frameworks. This helps companies to consolidate point solutions that would otherwise have to be managed separately, which can lead to complex deployments, operations and reporting. Veracode solutions integrate with the development pipeline so that analysis can be fully automated.

Veracode helps businesses to scale their security teams by engaging and empowering security champions within companies’ development teams. It guides teams towards targeted training; if one team has a higher frequency of the same security issue, it focuses its programmes on fixing vulnerabilities, not just finding them, so organisations don’t end up in the same position as Equifax.

Finally, it assists security teams with AppSec governance. This starts by helping businesses to define a programme to achieve compliance with internal policies, contractual requirements, regulatory mandates. It helps companies to scale programmes through best practices that we have developed over 15 years while working with over 2500 customers. Furthermore, it can also assist with selling the value of AppSec programmes to senior management, development teams and even customers.

Most AppSec programmes forget that there is only one role that can fix security finding and that`s the developer. Yet, many of them don’t empower developers to do so and focus their programmes on finding flaws and not fixing them.

Veracode offers developers three types of advice that delivers a high percentage of fixes. Firstly, they receive automated advice from Veracode’s solution in the form of text or video tutorials. Secondly, they can reach out to peers in the Veracode Community and see if they can find a solution there. Thirdly, they can schedule a call with a secure coding expert to go through the source code together and discuss approaches to fixing the issue. The Veracode approach makes this much easier because its consultants can view the data and control flow of the application to suggest the best way to fix issues.




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Cyber attackers used over 500 tools and tactics in 2022
Cyber Security News
The most common root causes of attacks were unpatched vulnerabilities and compromised credentials, while ransomware continues to be the most common ‘end game’ and attacker dwell time is shrinking – for better or worse.

Read more...
Addressing the SCADA in the room
Industrial (Industry) Cyber Security
Few other sectors command the breadth of purpose-built and custom devices necessary to function, as the industrial and manufacturing industries. These unique devices create an uncommon risk that must be assessed and understood to fully protect against incoming attacks.

Read more...
Recession or stress?
Cyber Security News
The economic landscape has seen many technology companies lay off vast numbers of employees, but for cybersecurity, the picture looks very different – a dynamic mixture of excitement, challenges and toxicity.

Read more...
Vulnerabilities in industrial cellular routers’ cloud management platforms
Industrial (Industry) Cyber Security Security Services & Risk Management
Research from OTORIO, a provider of operational technology cyber and digital risk management solutions, unveils cyber risks in M2M protocols and asset registration that expose hundreds of thousands of devices and OT networks to attack

Read more...
NEC XON appoints Armand Kruger as Head of Cybersecurity
News Cyber Security
NEC XON has announced the appointment of Armand Kruger as the Head of Cybersecurity. Kruger will oversee all cybersecurity offerings including cybersecurity strategy, programmes, and executive advisory.

Read more...
Caesar Tonkin new head of cybersecurity business, Armata
News Cyber Security
Vivica Holdings has announced the appointment of cybersecurity expert Caesar Tonkin to head up its cybersecurity business Armata, which provides technology solutions and niche expertise needed to help businesses better protect themselves.

Read more...
Surveillance-free surfing
News Cyber Security Products
Zoho has launched Ulaa, a privacy-centric browser built specifically to help users secure their personal data and activity by providing a browser solution that universally blocks tracking and website surveillance.

Read more...
Troye and Arctic Wolf join forces
News Cyber Security Security Services & Risk Management
Troye has announced a strategic partnership with Arctic Wolf to enable Troye to provide customers with enhanced cybersecurity solutions and services that help protect their businesses from advanced cyber threats.

Read more...
Relaxed home cybersecurity could render consumers accidental ‘inside actors’
Editor's Choice Cyber Security Smart Home Automation
Cisco security experts warn of snowball impact of relaxed approach to cybersecurity on personal devices, noting 60% of users primarily use their personal phone for work tasks and 76% have used unsecured public networks for work tasks.

Read more...
VMware unveils new security capabilities
Cyber Security IT infrastructure Products
At the RSA Conference 2023, VMware unveiled enhanced features for its suite of security solutions to address the increasing sophistication and scale of cyberattacks and to deliver strong lateral security across multi-cloud environments.

Read more...