Enhancing the security of your applications

Smart Cybersecurity Handbook 2022 Cyber Security

Is software part of how you are delivering value to your customers? But how is your organisation innovating through software?

Software adds value, but it also introduces risk. Let’s take the example of Equifax – described as a data ‘mega-breach’ that exposed the personal information of 147 million people and was caused by an application vulnerability that cost the company more than US$ 2 billion, with about US$ 700 million in settlements alone. The company went on to become the subject of US congressional hearings as well as several investigations.

The interesting thing about this is that they had application security tools in place, so what went wrong?

Veracode has partnered with companies to deliver application security programmes since 2006 and here are the most common reasons we see why secure software initiatives fail.

No remediation

Firstly, AppSec programmes fail when developers are not engaged or empowered to fix vulnerabilities and security teams are only incentivised to find weaknesses but not to remediate them. Too often, security teams dictate rather than partner with development teams and have unrealistic expectations. The mountain of technical debt can be enormous and developers are often not trained to fix potential liabilities. The net result is a toxic relationship between security and development.

Complex tools

Secondly, tooling is difficult to manage and many solutions require weeks, if not months, of deployment before they are able to conduct the first scan. Then come the operational headaches, plus scalability and high availability issues. Maintaining solutions can be challenging, leaving businesses months behind coverage for the language and framework versions their development teams are using.

To busy putting out fires

Thirdly, security teams are often busy running scans and keeping infrastructure up to date that they simply don’t have time to focus on the programme itself. They’re in a vicious cycle and don’t have the headcount to deliver an holistic AppSec programme that gets stakeholders aligned on the vision and roadmap for it. Reporting the correct metrics to C-Level executives on successes is difficult and hence programmes continue to be underfunded.

Most AppSec programmes forget that there is only one role that can fix security finding and that`s the developer. Yet, many of them don’t empower developers to do so and focus their programmes on finding flaws and not fixing them.

Veracode offers developers three types of advice that delivers a high percentage of fixes. Firstly, they receive automated advice from its solution in the form of text or video tutorials. Secondly, they can reach out to peers in the Veracode Community and see if it can find a solution there. Thirdly, it can schedule a call with a secure coding expert to go through the source code together and discuss approaches to fixing the issue. The Veracode approach makes this much easier because its consultants can view the data and control flow of the application to suggest the best way to fix issues.


Veracode’s approach to application security addresses these three areas:

• Veracode provides a unified solution for all major application analysis types, languages and frameworks. This helps companies to consolidate point solutions that would otherwise have to be managed separately, which can lead to complex deployments, operations and reporting. Veracode solutions integrate with the development pipeline so that analysis can be fully automated.

• We help businesses to scale their security teams by engaging and empowering security champions within companies’ development teams. We guide teams towards targeted training; if one team has a higher frequency of the same security issue, we focus our programmes on fixing vulnerabilities, not just finding them, so organisations don’t end up in the same position as Equifax.

• Finally, we assist security teams with AppSec governance. This starts by helping businesses to define a programme to achieve compliance with internal policies, contractual requirements and regulatory mandates. We help companies to scale programmes through best practices that we have developed over 15 years while working with over 2500 customers. Furthermore, we can also assist with selling the value of AppSec programmes to senior management, development teams and even customers.

For more information go to www.veracode.com




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Poor router security makes SMBs vulnerable to attack
Cyber Security
While major malware and ransomware incidents frequently make headlines in the media, router vulnerabilities are not as frequently publicised, but the outcomes of these violations could be immensely damaging.

Read more...
Cybercriminals eye South African SMEs lack of security
Cyber Security
Just as a business owner wouldn’t underinsure a tangible business asset such as a factory, SMEs shouldn’t leave their digital assets unlocked and in plain sight of criminals.

Read more...
Harnessing the power of AI-driven XDR
Cyber Security
According to AIMultiple, 90% of infosec personnel in the U.S. and Japan said they’re anticipating an increase in these automated attack campaigns, due in no small part to the public availability of AI research.

Read more...
Be prepared for the increase in reconnaissance
Cyber Security
Because ransomware has become so lucrative, cybercriminals are becoming more devious and putting significantly more energy into reconnaissance.

Read more...
Cybereason expands presence across sub-Saharan Africa
News Cyber Security
Cybereason has appointed Chantél Hamman as its new channel director focused on growing the company’s presence across sub-Saharan Africa.

Read more...
How to weather the approaching perfect storm
Cyber Security
Cybercrime is spiking and security skills are scarce, and small and medium enterprises (SMEs) are particularly vulnerable as the financial impact of falling victim to these security breaches can result in their total collapse.

Read more...
Cyber resilience is more than security
Industrial (Industry) Cyber Security IT infrastructure
Kate Mollett, regional director at Commvault Africa advises companies to guard against cyberattacks in the shipping and logistics sector using an effective recovery strategy.

Read more...
Preventing cyberattacks on critical infrastructure
Industrial (Industry) Cyber Security
Cyberattacks have the potential to disrupt our lives completely, and in instances where critical national infrastructure is attacked, they could disrupt the country’s entire economy, leading to loss of life and livelihoods.

Read more...
Cybersecure surveillance cameras
HiTek Security Distributors News CCTV, Surveillance & Remote Monitoring Cyber Security
Provision-ISR builds customer trust and opens up new opportunities with Check Point Quantum IoT Protect Firmware built into Provision-ISR cameras.

Read more...
Why SBOMs are mission critical
Hikvision South Africa Cyber Security
When deployed and managed properly, software bill of materials can provide a 360-degree view of an organisation’s risk exposure to software supply chain threats and vulnerabilities.

Read more...