Why
Secure Application Development
Is Critical to Conscious Companies

The number of conscious companies increases every year, with the trend even impacting how business takes place. Many people have looked at the results of the popular business philosophy that calls for profit above all else, and have decided the pendulum needs to swing back.

In other words, it’s becoming more important for companies to be extremely conscious of the impact their actions have on business and society.

And, as a result, secure application development is now more important than ever before. With the number of security breaches on the rise, and hackers working harder to access the growing amounts of private information stored online, developers must take security testing seriously on every project.

IS IT ETHICAL TO DELIVER APPLICATIONS WITHOUT EFFECTIVE SECURITY TESTING?

In today’s hackable environment, secure software application development – or lack thereof – raises an ethical question. The consequences of poor software security bring this issue into sharp focus.

• In 2017, IBM sponsored the 12th annual Cost of Data Breach Study conducted by Ponemon Institute. Globally, the study found that the cost of a data breach dropped 10 percent over 2016 numbers, yet the cost of a data breach in the U.S. rose 5 percent to $7.35 million. The study figures include costs related to responding to the breach, damage to reputations and lost business.
• Companies of all sizes are not only vulnerable, but in jeopardy. SMBs sometimes assume that only large corporations need to worry about data breaches.

• The number of municipal, state and federal government attacks is growing. For example, a ransomware attack in March 2018 disrupted several critical services in the city of Atlanta, including the judicial system and police department.
• The Equifax data breach in 2017 has continued to grow in severity. Some of the latest numbers indicate that the massive breach impacted roughly half the U.S. population, or 147.9 million consumers. There’s little disagreement about whether consumer confidence in Equifax has taken a huge plunge.
• The European Union is starting enforcement of its General Data Protection Regulation (GDPR) in May 2018. It will have a long-term impact on data security issues around the world. Companies are scrambling to update their data security and privacy policies and to ensure their systems align with the new Regulation.

Given the problems that continue to occur, no software developer can ignore the repercussions of less-than-stellar security for both themselves and their clients.

TYPES OF SECURITY TESTING

Fundamentally, you need to do software security testing from seven different perspectives. Each type of testing is designed to address specific security risks.

Risk Assessments: Risk assessments are designed to identify potential risks that could occur. The assessment is intended to 1) identify the risk, 2) determine how to reduce the impact of the risk, 3) reduce the likelihood of the risk occurring, and 4) monitor risks.

Security Scanning: This process focuses on identifying network and system weaknesses and developing solutions to reduce the risks.

Vulnerability Scanning: This test uses automated software to scan a system to find known vulnerability signatures. It also implements fixes to eliminate the vulnerabilities.

Penetration Scanning: Penetration scanning takes finding vulnerabilities to a higher level. Rather than stopping upon the discovery of vulnerabilities, the penetration tester will exploit the vulnerability to discover how a hacker could take control of the system.

Ethical Hacking: Testers attempt to penetrate the applications and systems in the same manner a criminal hacker might try.

Security Auditing: Regular auditing of applications and systems works to identify security flaws.

Posture Assessment: This term refers to the use of scans, ethical hacking and risk assessments to illustrate an organization’s overall software and system security posture.