Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Application Security: We Still Have A Long Way To Go
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
planetlevel
planetlevel,
User Rank: Author
12/9/2013 | 12:58:09 PM
Re: App security tools ?
@danielcawrey At least as far as security is concerned, I believe that the lack of management support is a direct result of the lack of visibility into security.  Management gets a very unclear and spotty view of security across their application portfolio -- even on projects where security is a priority.  Developers can improve this visibility dramatically by writing test cases and other simple tools that demonstrate the security of their code.  For example, write a tool that shows all of your HTTP headers are set properly.  Or that every controller has the proper access control checks.  You'll find problems earlier and create the visibility that allows management to support you better!

--Jeff
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
12/9/2013 | 12:14:33 PM
Re: Re : Application Security: We Still Have A Long Way To Go
Gr8 advice, Jeff. Thanks. Here's the link to the OWASP DependencyCheck for anyone interested. This is also a good venue -- while you've got Jeff's ear -- to let him know how you like it and else resources you'd like to see in the OWASP libraries and frameworks.
planetlevel
planetlevel,
User Rank: Author
12/9/2013 | 11:57:57 AM
Re: Re : Application Security: We Still Have A Long Way To Go
@SachinEE -- Probably the first and best thing to do is to make sure you're using the latest version of your libraries and frameworks.   At least the ones with known vulnerabilities.  There are a few commercial tools, but the OWASP DependencyCheck is a great way to start.  Long term, we are going to a lot more help finding, selecting, integrating, maintaining, updating, and generally managing our libraries and frameworks.

--Jeff
planetlevel
planetlevel,
User Rank: Author
12/9/2013 | 11:54:07 AM
Re: App security tools ?
Hi irakov,

You're right that developers are often put into the very difficult position of being blamed for security problems without the proper process/tools/time/etc... to actually make that happen.  I gave a talk recently "Application Security at DevOps Speed and Portfolio Scale" that presents a new approach to this dilemma.  I'll be writing more about this, but I'd love to hear your thoughts.  youtube.com/watch?v=cIvOth0fxmI

--Jeff
SachinEE
SachinEE,
User Rank: Apprentice
11/27/2013 | 1:09:29 AM
Re : Application Security: We Still Have A Long Way To Go
This is quite understandable that when developers have to leverage their app with other sources like libraries which are not under their control they are dealing with danger. What could possibly be done about it? Should they be selective about giving access to libraries considering potential vulnerabilities which come with them? Or they can actually do something about those vulnerabilities?
SachinEE
SachinEE,
User Rank: Apprentice
11/27/2013 | 1:09:24 AM
Re : Application Security: We Still Have A Long Way To Go
@ danielcawrey, I strongly agree with you on this. It is a problem developers have always been complaining about that they are not given sufficient time to do their job thoroughly and their own way. When you are tightly running against time, you are sure to miss out on some minor things which in case of application development don't prove to be that minor vulnerabilities.
Chuck Brooks
Chuck Brooks,
User Rank: Apprentice
11/26/2013 | 1:01:52 PM
applications security
Beyond encryption, new technologies/processes (keyless authentication) for secure applications are being developed. I believe that that will be the future of data integrity.
J_Brandt
J_Brandt,
User Rank: Apprentice
11/24/2013 | 4:54:35 PM
Re: OWASP A9 & Components
Time is not given for appropriate security testing because security still doesn't rate high enough in enough people's minds.  That has to change.
marktroester
marktroester,
User Rank: Apprentice
11/22/2013 | 2:33:02 PM
OWASP A9 & Components
Thanks for article Jeff, and your presentations at AppSecUSA! It's great to see that OWASP has recognized the prevalence of components in today's applications. Sonatype has done research that indicates that the average application consists of 80% or more open source components. While using components like web frameworks, logging utilities, database access routines, etc., speed development, if organizations don't manage the use of components, they can put the organization at risk.

We published a whitepaper that addresses the A9 requirement and application components -

http://www.sonatype.com/resources/whitepapers

There is also a PCI related whitepaper as well.

Thanks, 

Mark Troester

Sonatype

@mtroester

 
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
11/22/2013 | 8:08:55 AM
Re: App security tools ? & deadlines and security priorities
I've heard that complaint from developers many times, danielcawrey. What do you think management should know about the software development process that would lead to better application security? 
Page 1 / 2   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Black Hat USA 2022 Attendee Report
Black Hat attendees are not sleeping well. Between concerns about attacks against cloud services, ransomware, and the growing risks to the global supply chain, these security pros have a lot to be worried about. Read our 2022 report to hear what they're concerned about now.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-2597
PUBLISHED: 2022-08-08
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none.
CVE-2017-2631
PUBLISHED: 2022-08-08
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none.
CVE-2017-2657
PUBLISHED: 2022-08-08
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none.
CVE-2017-7527
PUBLISHED: 2022-08-08
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none.
CVE-2021-41615
PUBLISHED: 2022-08-08
websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise value, which does not follow the secret-data guideline for HTTP Digest Access Authentication in RFC 7616 section 3.3 (or RFC 2617 section 3.2.1). NOTE: 2.1...