Kayla Matthews
tech journalist & writer http://productivitybytes.com http://productivitybytes.com
Application security, often abbreviated as AppSec, is a crucial part of application development. AppSec encompasses the measures taken to ensure an app is not prone to breaches.
Having an AppSec strategy in place is essential, but it's also necessary to avoid some of the mistakes that could cause AppSec plans to fail. Here are five of them:
1. Trying to Fix Every Bug
A study from Secunia looked at 3,870 products and found more than 15,435 total vulnerabilities. That number didn't include security gaps in custom or legacy code, meaning the actual figure was likely substantially larger. Then, different research showed that web app vulnerabilities were the top kind of successful breaches, accounting for one out of every five incidents.
It's not realistic for security teams to locate every bug, then task people with fixing them. New threats arise too frequently, so it's necessary to evaluate things differently.
A feasible and proactive AppSec strategy means prioritizing fixing bugs by risk level, not frantically trying to patch every existing problem. Looking at factors such as the overall severity of the vulnerability and the sensitivity of the data affected can help developers triage issues.
2. Focusing on Innovation Over Security
When developers build apps that are particularly pioneering, there's often a rush to get them to the marketplace before competitors release similar products. Research indicates that Chief Information Officers (CIOs) frequently get told by superiors to emphasize innovation more than security, even at previously hacked organizations.
Adopting a better mindset means understanding that moving quickly to make new offerings available is useless if apps are riddled with issues that put people's information at risk and make them reluctant to use the apps. When possible, CIOs and other security experts should remind corporate leaders of the expenses and reputational damage that could result from releasing something hastily.
3. Taking a Reactive Approach to AppSec
If companies have low budgets or lack human resources, they may be particularly likely to react to the security issues highlighted in their apps after problems occur. In that case, there's a "bolted on" view of security, meaning that developers tack on security measures later and only when necessary.
But like the approach of making innovation more important than app security, reacting to issues after they happen is costly in numerous ways. Incorporating security into every stage of app development is the preferred approach. Doing so allows development teams to spot issues before the public does.
In a recent example, Tik Tok, one of the world's most popular apps, came under fire for not doing enough to protect data associated with minors. Although the app is not intended for people under 16, there are people much younger than that using it and exposing data that could make them targets for criminals.
Also, when companies neglect to solve AppSec issues for too long, those problems could affect large population bases, such as people who use apps to book hospital appointments or schedule apartment maintenance. Fortunately, mass notification services can help spread the word quickly, which could mitigate the damage caused to your company.
4. Failing to Train Staff About AppSec Principles
According to a Synopsys infographic, less than three percent of undergraduate computer science programs include security components. That educational shortcoming means companies cannot assume the developers they've hired recently or those who are already part of the workforce have the necessary security skills needed to excel in AppSec.
Synopsis found that application security training reduces the likelihood of breaches by 70 percent. Also, when employers pay for their staff to get trained or certified in AppSec, those offerings have positive effects on worker retention. When corporate leaders view employee education as a necessary and worthy long-term investment, they strengthen their companies for the future.
5. Dismissing Vulnerabilities as Merely Theoretical
Even when companies run security scans to find the most glaring holes in their applications, they often disregard the results, rationalizing that the risks are only theoretical and not likely to occur in real life. But analyzing security risks with tools often allows developers to find things they'd otherwise miss.
It's ideal for companies to come up with processes for gauging the vulnerabilities found instead of quickly deciding they're unimportant.
What's Ahead for AppSec?
Tackling many shortcomings in AppSec strategies requires an all-encompassing viewpoint and willingness to do things differently. Implementing automation tools should help, along with moving forward with the suggestions mentioned here. IoT vulnerabilities, cross-site scripting (XSS) and content management system bugs are some of the most recent AppSec threats challenging companies.
Course Correction Could Give Long-Term Benefits
No AppSec strategy is perfect, and knowing the flaws is half the battle. Fixing the weak points in your existing plan could increase the prominence of a company and its offerings.
