A new Quocirca report underlines the scale of the application security challenge faced by businesses. The average enterprise tracks around 500 mission-critical applications; in financial services organisations it is closer to 800. The security challenge arises because more and more of these applications are web-enabled. Furthermore, businesses are increasingly relying on software provided as a service (SaaS) and apps that run on mobile devices, both of which are, by definition, web-enabled.

Businesses worry about application security for three reasons. First, security failures leave them vulnerable to hackers and malware; secondly, auditors expect application security to be demonstrable; and third, customers, with who they share business processes via applications, are also increasingly likely to seek security guarantees.

There are a number of approaches that can be taken to ensure better application security. For in-house developed software, best practices can be better ensured through training of developers. For commercially acquired software, due diligence during procurement is necessary, seeking assurances from independent software vendors (ISV). However, these measures can never ensure that software is 100% secure.

For this reason there are three other approaches which should be considered: 

1. Application scanning: scanning software eliminates flaws in the first place. There are two approaches - the static scanning of code or binaries before deployment and the dynamic scanning of binaries during testing or after deployment. Static scanning is pervasive, looking at every line of code. Scans can be conducted as regularly as is deemed necessary. Whilst on-premise scanning tools have been relied on in the past, the use of on-demand scanning services has become increasingly popular as the providers of such services have visibility in to the tens of thousands of applications scanned on behalf of thousands of customers. Such services are often charged for on a per-application basis, so unlimited scans can be carried out, even on a daily basis. The relatively low cost of on-demand scanning services makes them affordable and scalable for all applications including non-mission critical ones.
2. Manual penetration testing (pen-testing): where specialist third parties are engaged to test the security of applications and effectiveness of defences. These are white-hats, deliberately trying to hack applications but with no bad intent (as opposed to black hats). Because actual people are involved in the process, pen-testing is relatively expensive and only carried out periodically; new threats may emerge between tests. Most organisations will find pen-testing unaffordable for all deployed software and is generally reserved for the most sensitive and vulnerable applications.
3. Web application firewalls (WAF): these are placed in front of applications to protect them from application-focussed threats. They are more complex to deploy than traditional network firewalls and, whilst affording good protection, do nothing to fix the underlying flaws in software. WAFs also need to scale with traffic volumes; more traffic means more cost.

100% software security is never going to be guaranteed and many organisations use multiple approaches to maximise protection. However, interestingly, as one of the reasons for having demonstrable software security is to satisfy auditors, compliance bodies do not themselves mandate multiple approaches for compliance. For example the Payment Card Industry Security Standards Council (PCI-SSC) deems code scanning to be an acceptable alternative to a WAF.

For today’s businesses the use of software is not a choice; however the methods chosen to improve software security and, in turn, the costs involved and the benefits achieved are. Using the right mix of approaches at all stages of the software development, procurement and deployment life cycle will improve the efficiency, reliability, security, compliance and competitiveness of business processes.

Quocirca’s report “Outsourcing the problem of software security” is freely available here:
http://info.veracode.com/Quocirca_Outsourcing_Software_security.html

From Quocirca there will also be an online webinar, a recording of which will be available from March 16th 2012 here:
http://www.bankinfosecurity.com/webinars.php?webinarID=268&preview=inactive_webinar