How to create a more effective application security program
To mitigate software-related security risks, fine-tune your application security program to get the right people involved, document your standards and manage your weak points.
Contrary to popular belief, application security requires a lot more than meets the eye.
Many people assume application security consists of a set of technical parameters that make up part of the software development lifecycle. As a result, they think an application security program simply requires periodic vulnerability scanning and penetration testing. Still others think application security rests on developers' shoulders.
Rather than relying on a single test, improving application security requires all of the above and more. Most organizations still have more to do before their application security program can help them fully avoid software-related security risks.
You should also fine-tune your application security program to make strides in overall business resiliency. Without performing a single vulnerability scan, code review or software development lifecycle analysis, the odds are good that if you address the following areas, you'll make some serious headway in terms of minimizing your software-related security risk.
Get the right people on board
Security programs don't fail due to a lack of interest. It's safe to say security is one of the hottest areas of business today.
What tends to happen, however, is that organizations aren't getting and keeping the right people involved to make sure application security initiatives are in line with business goals. You might need your CEO or directors in HR or finance to help drive security. Even sales leaders and legal counsels have evolved into driving forces behind security -- application security included. In today's world, more and more people are motivated to get behind security given how it impacts competitive and business differentiation.
Document application security standards
An application security program can't flourish without a set of standards for guidance. It's easy to proclaim that your applications include good security using the OWASP Top Ten as the benchmark. But without minimum standards to guide your practices, you're just going through the motions.
Software won't secure itself, nor will it remain secure without diligent, ongoing efforts.
Look at your business requirements in terms of risk and resiliency. Look at your threats and your current gaps and weaknesses. Adopt standards to help address those areas. Beyond that, use proven principles to create a set of goals everyone is on board with and on which you can set your long-term sights.
Measure for improvement
Some people associate any action with positive forward momentum. But you can only properly manage the things you measure. Otherwise, you're shooting in the dark and guessing at what you need to address and improve.
Foolishly, many people assume they can keep doing what they've been doing because they stay busy and it allows them to check a box. That's not going to cut it, though, especially as compliance requirements evolve and security expectations grow.
It's best to figure out what matters to the business in terms of application security, then focus on the weak or blind spots. Improvements may need to be made in the requirements phase, including properly scoping for security testing. Or perhaps you need better threat modeling.
Whatever it is, measure what you're doing and how you're doing it. If you're strict and hold yourself and others accountable to address the gaps, improvements will certainly follow.
Remember: Software won't secure itself
In the end, the security of your software depends on these few vital components and discipline on the part of your team, including developers, security analysts, product and project managers, and even executive leadership.
Software won't secure itself, nor will it remain secure without diligent, ongoing efforts. If you want to remain out of the headlines and in the good graces of your customers, business partners, auditors and regulators, you need to take action.
Stop going through the motions of functional testing, user acceptance testing and maybe the occasional vulnerability scan. There's much more to application security than that.
You can think of it as a miniature information security program. Your plan needs to have goals, oversight and responsibilities. Criminal hackers won't like it, but that's the only way forward in 2019 and beyond.
