Enhancing the security of your applications

Issue 7 2021 Cyber Security

Is software part of how you are delivering value to your customers? But how is your organisation innovating through software?

Software adds value, but it also introduces risk. Let’s take the example of Equifax, described as a data ‘mega-breach’ that exposed the personal information of 147 million people and was caused by an application vulnerability that cost the company more than US$2 billion, with about US$700 million in settlements alone. The company went on to become the subject of US congressional hearings as well as several investigations.

The interesting thing about this is that they had application security tools in place, so what went wrong?

Veracode has partnered with companies to deliver application security programmes since 2006 and here are the most common reasons the company sees why secure software initiatives fail.

No remediation

Firstly, AppSec programmes fail when developers are not engaged or empowered to fix vulnerabilities and security teams are only incentivised to find weaknesses, but not to remediate them. Too often, security teams dictate rather than partner with development teams and have unrealistic expectations. The mountain of technical debt can be enormous and developers are often not trained to fix potential liabilities. The net result is a toxic relationship between security and development.

Complex tools

Secondly, tooling is difficult to manage and many solutions require weeks, if not months, of deployment before they are able to conduct the first scan. Then come the operational headaches, plus scalability and high availability issues. Maintaining solutions can be challenging, leaving businesses months behind coverage for the language and framework versions their development teams are using.

To busy putting out fires

Thirdly, security teams are often busy running scans and keeping infrastructure up to date that they simply don’t have time to focus on the programme itself. They’re in a vicious cycle and don’t have the headcount to deliver an holistic AppSec programme that gets stakeholders aligned on the vision and roadmap for it. Reporting the correct metrics to C-Level executives on successes is difficult and hence programmes continue to be underfunded.

Veracode’s approach to application security addresses these three areas:

Veracode provides a unified solution for all major application analysis types, languages, and frameworks. This helps companies to consolidate point solutions that would otherwise have to be managed separately, which can lead to complex deployments, operations and reporting. Veracode solutions integrate with the development pipeline so that analysis can be fully automated.

Veracode helps businesses to scale their security teams by engaging and empowering security champions within companies’ development teams. It guides teams towards targeted training; if one team has a higher frequency of the same security issue, it focuses its programmes on fixing vulnerabilities, not just finding them, so organisations don’t end up in the same position as Equifax.

Finally, it assists security teams with AppSec governance. This starts by helping businesses to define a programme to achieve compliance with internal policies, contractual requirements, regulatory mandates. It helps companies to scale programmes through best practices that we have developed over 15 years while working with over 2500 customers. Furthermore, it can also assist with selling the value of AppSec programmes to senior management, development teams and even customers.

Most AppSec programmes forget that there is only one role that can fix security finding and that`s the developer. Yet, many of them don’t empower developers to do so and focus their programmes on finding flaws and not fixing them.

Veracode offers developers three types of advice that delivers a high percentage of fixes. Firstly, they receive automated advice from Veracode’s solution in the form of text or video tutorials. Secondly, they can reach out to peers in the Veracode Community and see if they can find a solution there. Thirdly, they can schedule a call with a secure coding expert to go through the source code together and discuss approaches to fixing the issue. The Veracode approach makes this much easier because its consultants can view the data and control flow of the application to suggest the best way to fix issues.

For more information go to www.veracode.com




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Dashboard for streamlined ransomware recovery
Cyber Security
The new CyberSense interface provides intuitive post-attack forensic reports that provide powerful insight into data corruption due to a ransomware attack, facilitating ransomware recovery.

Read more...
You have a ‘super malicious insider’
J2 Software Cyber Security
There’s a super malicious insider who is technically proficient and often acutely aware of an organisation’s technical limitations in proactively detecting insider threats.

Read more...
Secret monthly fee
Kaspersky Cyber Security
Kaspersky researchers have observed fraudsters actively spreading Trojans, which secretly subscribe users to paid services, disguised as various mobile apps, including popular games, healthcare apps and photo editors.

Read more...
Keep cloud-based security simple
Cyber Security
SA businesses have more mobile workforces now, which means a greater need for cloud security that follows data and users wherever they are amidst increase in cyberattacks.

Read more...
How crypto cons work and how to protect yourself
Cyber Security
The digital gold rush is here. As more people attempt to make money from cryptocurrencies, criminals and con artists aren’t far behind, says Carey van Vlaanderen, CEO of ESET South Africa.

Read more...
Ongoing cybersecurity with a click
Technews Publishing Editor's Choice Cyber Security Security Services & Risk Management
Maintain your cybersecurity posture with web services from Pretect designed to keep your IT infrastructure optimally protected 24 x 7.

Read more...
The battle of AI and ML in the cybersecurity world
Cyber Security Products
The security industry is using ML/AI in various applications such as tackling huge volumes of malware, detecting spam and business email compromises, analysing network traffic, using facial recognition and more.

Read more...
Cyber questions for today’s business
Cyber Security
Roberto Arico, Cybereason senior sales engineer for Africa, answers cybersecurity questions companies need to consider in the present risk landscape.

Read more...
Exclusive Networks Africa expands security services
Cyber Security News Products
Exclusive Networks Africa announced a new partnership agreement with Infoblox to simplify complex distributed networking and security, by delivering modern, cloud-first networking and security services that automate and streamline user experiences.

Read more...
How cloud computing affects businesses in RSA
Cyber Security
In order to optimise the benefits of data security in enterprises, cloud computing solutions must be considered as part of a comprehensive security strategy.

Read more...