Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Application Security: We Still Have A Long Way To Go
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
planetlevel
50%
50%
planetlevel,
 User Rank: Author
12/9/2013 | 12:58:09 PM
Re: App security tools ?
@danielcawrey At least as far as security is concerned, I believe that the lack of management support is a direct result of the lack of visibility into security.  Management gets a very unclear and spotty view of security across their application portfolio -- even on projects where security is a priority.  Developers can improve this visibility dramatically by writing test cases and other simple tools that demonstrate the security of their code.  For example, write a tool that shows all of your HTTP headers are set properly.  Or that every controller has the proper access control checks.  You'll find problems earlier and create the visibility that allows management to support you better!

--Jeff
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
 User Rank: Strategist
12/9/2013 | 12:14:33 PM
Re: Re : Application Security: We Still Have A Long Way To Go
Gr8 advice, Jeff. Thanks. Here's the link to the OWASP DependencyCheck for anyone interested. This is also a good venue -- while you've got Jeff's ear -- to let him know how you like it and else resources you'd like to see in the OWASP libraries and frameworks.
planetlevel
50%
50%
planetlevel,
 User Rank: Author
12/9/2013 | 11:57:57 AM
Re: Re : Application Security: We Still Have A Long Way To Go
@SachinEE -- Probably the first and best thing to do is to make sure you're using the latest version of your libraries and frameworks.   At least the ones with known vulnerabilities.  There are a few commercial tools, but the OWASP DependencyCheck is a great way to start.  Long term, we are going to a lot more help finding, selecting, integrating, maintaining, updating, and generally managing our libraries and frameworks.

--Jeff
planetlevel
50%
50%
planetlevel,
 User Rank: Author
12/9/2013 | 11:54:07 AM
Re: App security tools ?
Hi irakov,

You're right that developers are often put into the very difficult position of being blamed for security problems without the proper process/tools/time/etc... to actually make that happen.  I gave a talk recently "Application Security at DevOps Speed and Portfolio Scale" that presents a new approach to this dilemma.  I'll be writing more about this, but I'd love to hear your thoughts.  youtube.com/watch?v=cIvOth0fxmI

--Jeff
SachinEE
50%
50%
SachinEE,
 User Rank: Apprentice
11/27/2013 | 1:09:29 AM
Re : Application Security: We Still Have A Long Way To Go
This is quite understandable that when developers have to leverage their app with other sources like libraries which are not under their control they are dealing with danger. What could possibly be done about it? Should they be selective about giving access to libraries considering potential vulnerabilities which come with them? Or they can actually do something about those vulnerabilities?
SachinEE
100%
0%
SachinEE,
 User Rank: Apprentice
11/27/2013 | 1:09:24 AM
Re : Application Security: We Still Have A Long Way To Go
@ danielcawrey, I strongly agree with you on this. It is a problem developers have always been complaining about that they are not given sufficient time to do their job thoroughly and their own way. When you are tightly running against time, you are sure to miss out on some minor things which in case of application development don't prove to be that minor vulnerabilities.
Chuck Brooks
50%
50%
Chuck Brooks,
 User Rank: Apprentice
11/26/2013 | 1:01:52 PM
applications security
Beyond encryption, new technologies/processes (keyless authentication) for secure applications are being developed. I believe that that will be the future of data integrity.
J_Brandt
50%
50%
J_Brandt,
 User Rank: Apprentice
11/24/2013 | 4:54:35 PM
Re: OWASP A9 & Components
Time is not given for appropriate security testing because security still doesn't rate high enough in enough people's minds.  That has to change.
marktroester
50%
50%
marktroester,
 User Rank: Apprentice
11/22/2013 | 2:33:02 PM
OWASP A9 & Components
Thanks for article Jeff, and your presentations at AppSecUSA! It's great to see that OWASP has recognized the prevalence of components in today's applications. Sonatype has done research that indicates that the average application consists of 80% or more open source components. While using components like web frameworks, logging utilities, database access routines, etc., speed development, if organizations don't manage the use of components, they can put the organization at risk.

We published a whitepaper that addresses the A9 requirement and application components -

http://www.sonatype.com/resources/whitepapers

There is also a PCI related whitepaper as well.

Thanks, 

Mark Troester

Sonatype

@mtroester

 
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
 User Rank: Strategist
11/22/2013 | 8:08:55 AM
Re: App security tools ? & deadlines and security priorities
I've heard that complaint from developers many times, danielcawrey. What do you think management should know about the software development process that would lead to better application security? 
Page 1 / 2   >   >>


COVID-19: Latest Security News & Commentary
Dark Reading Staff 11/19/2020
New Proposed DNS Security Features Released
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/19/2020
How to Identify Cobalt Strike on Your Network
Zohar Buber, Security Analyst,  11/18/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25159
PUBLISHED: 2020-11-24
499ES EtherNet/IP (ENIP) Adaptor Source Code is vulnerable to a stack-based buffer overflow, which may allow an attacker to send a specially crafted packet that may result in a denial-of-service condition or code execution.
CVE-2020-25654
PUBLISHED: 2020-11-24
An ACL bypass flaw was found in pacemaker before 1.1.24-rc1 and 2.0.5-rc2. An attacker having a local account on the cluster and in the haclient group could use IPC communication with various daemons directly to perform certain tasks that they would be prevented by ACLs from doing if they went throu...
CVE-2020-28329
PUBLISHED: 2020-11-24
Barco wePresent WiPG-1600W firmware includes a hardcoded API account and password that is discoverable by inspecting the firmware image. A malicious actor could use this password to access authenticated, administrative functions in the API. Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19.
CVE-2020-29053
PUBLISHED: 2020-11-24
HRSALE 2.0.0 allows XSS via the admin/project/projects_calendar set_date parameter.
CVE-2020-25640
PUBLISHED: 2020-11-24
A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file.