Enhancing the security of your applications

Issue 7 2021 Information Security

Is software part of how you are delivering value to your customers? But how is your organisation innovating through software?

Software adds value, but it also introduces risk. Let’s take the example of Equifax, described as a data ‘mega-breach’ that exposed the personal information of 147 million people and was caused by an application vulnerability that cost the company more than US$2 billion, with about US$700 million in settlements alone. The company went on to become the subject of US congressional hearings as well as several investigations.

The interesting thing about this is that they had application security tools in place, so what went wrong?

Veracode has partnered with companies to deliver application security programmes since 2006 and here are the most common reasons the company sees why secure software initiatives fail.

No remediation

Firstly, AppSec programmes fail when developers are not engaged or empowered to fix vulnerabilities and security teams are only incentivised to find weaknesses, but not to remediate them. Too often, security teams dictate rather than partner with development teams and have unrealistic expectations. The mountain of technical debt can be enormous and developers are often not trained to fix potential liabilities. The net result is a toxic relationship between security and development.

Complex tools

Secondly, tooling is difficult to manage and many solutions require weeks, if not months, of deployment before they are able to conduct the first scan. Then come the operational headaches, plus scalability and high availability issues. Maintaining solutions can be challenging, leaving businesses months behind coverage for the language and framework versions their development teams are using.

To busy putting out fires

Thirdly, security teams are often busy running scans and keeping infrastructure up to date that they simply don’t have time to focus on the programme itself. They’re in a vicious cycle and don’t have the headcount to deliver an holistic AppSec programme that gets stakeholders aligned on the vision and roadmap for it. Reporting the correct metrics to C-Level executives on successes is difficult and hence programmes continue to be underfunded.

Veracode’s approach to application security addresses these three areas:

Veracode provides a unified solution for all major application analysis types, languages, and frameworks. This helps companies to consolidate point solutions that would otherwise have to be managed separately, which can lead to complex deployments, operations and reporting. Veracode solutions integrate with the development pipeline so that analysis can be fully automated.

Veracode helps businesses to scale their security teams by engaging and empowering security champions within companies’ development teams. It guides teams towards targeted training; if one team has a higher frequency of the same security issue, it focuses its programmes on fixing vulnerabilities, not just finding them, so organisations don’t end up in the same position as Equifax.

Finally, it assists security teams with AppSec governance. This starts by helping businesses to define a programme to achieve compliance with internal policies, contractual requirements, regulatory mandates. It helps companies to scale programmes through best practices that we have developed over 15 years while working with over 2500 customers. Furthermore, it can also assist with selling the value of AppSec programmes to senior management, development teams and even customers.

Most AppSec programmes forget that there is only one role that can fix security finding and that`s the developer. Yet, many of them don’t empower developers to do so and focus their programmes on finding flaws and not fixing them.

Veracode offers developers three types of advice that delivers a high percentage of fixes. Firstly, they receive automated advice from Veracode’s solution in the form of text or video tutorials. Secondly, they can reach out to peers in the Veracode Community and see if they can find a solution there. Thirdly, they can schedule a call with a secure coding expert to go through the source code together and discuss approaches to fixing the issue. The Veracode approach makes this much easier because its consultants can view the data and control flow of the application to suggest the best way to fix issues.




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

All aspects of data protection
Technews Publishing Editor's Choice Information Security Infrastructure AI & Data Analytics
SMART Security Solutions spoke to Kate Mollett, Senior Director, Commvault Africa, about the company and its evolution from a backup specialist to a full data protection specialist, as well as the latest announcements from the company.

Read more...
The song remains the same
Sophos Information Security
Sophos report found that telemetry logs were missing in nearly 42% of the attack cases studied. In 82% of these cases, cybercriminals disabled or wiped out the telemetry to hide their tracks.

Read more...
How hackers exploit our vulnerabilities
Information Security Risk Management & Resilience
Distractions, multi-tasking, and emotional responses increase individuals’ vulnerability to social engineering, manipulation, and various forms of digital attacks; 74% of all data breaches included a human element.

Read more...
Projections for 2024’s Advanced Threats Landscape
News & Events Information Security
Kaspersky Global Research and Analysis Team (GReAT) experts offer insights and projections for 2024 in the Kaspersky Security Bulletin, with a focus on the evolution of Advanced Persistent Threats (APT).

Read more...
Veeam and Sophos in strategic partnership
Information Security
Veeam and Sophos unite with a strategic partnership to advance the security of business-critical backups with managed detection and response for cyber resiliency, and to quickly recover impacted data by exchanging critical information.

Read more...
Unmasking insider risks
Information Security
In today’s business landscape, insider risks can manifest in various forms, including data theft, fraud, sabotage, insider trading, espionage, whistleblowing, negligence, truck hijacking, goods robbery from warehouses, and more.

Read more...
When technology is not enough
Information Security
[Sponsored] Garith Peck, Executive Head of Department for Security at Vodacom Business, writes about the importance of creating a cybersecurity strategy in a world where threats never sleep.

Read more...
Reinforcing cyber defences in a world of evolving threats
Sophos Information Security
[Sponsored Content] In South Africa, the urgency to amplify cybersecurity measures is underscored by alarming statistics revealing the continued vulnerability of organisations to ransomware and other sophisticated cyberattacks.

Read more...
Trellix detects collaboration by cybercriminals and nation states
News & Events Information Security
Trellix has released The CyberThreat Report: November 2023 from its Advanced Research Centre, highlighting new programming languages in malware development, adoption of malicious GenAI, and acceleration of geopolitical threat activity.

Read more...
SA enterprises can benefit from AI-driven cybersecurity
AI & Data Analytics Information Security
Cybercrime is big business, and threat actors deploy cutting-edge tools to carry out attacks. Fortunately, cybersecurity is constantly evolving to meet and counter the threats they face.

Read more...