Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

9/23/2013
04:55 PM
50%
50%

Lack Of Security Expertise? App-Analysis Services Could Help

Companies now have a selection of software-scanning services to help assess their Web applications and find bugs -- here's a look at what makes a good service

For companies developing their own in-house applications or Web services, vulnerabilities need to be found and fixed before deploying code -- or firms risk a breach.

In 2012, for example, poor input validation for databases put SQL injection on top of the short list of vulnerability-related attacks, with the three largest breaches compromising nearly 20 million records, according to the State of Software Security Report released annually by application-security firm Veracode. While the tools are available to solve the problems, developers are still focused on features over security.

Part of the problem is the lack of necessary security expertise. Without a focus on security, developers are hard-pressed to find and close the vulnerabilities in their code, says Brian Mizelle, vice president of operations at Cigital, a vulnerability software and service provider.

"What we are finding in the market is that vulnerabilities are piling up, and no one is able to bring that queue down," Mizelle says. "This is all about fixing them, verifying them, and getting the cycle going again, so companies are not piling on vulnerability after vulnerability, with the same ones showing up every time they test their code."

A number of companies are trying to solve the problem by offering automated static-code checking and dynamic vulnerability scanning as cloud services. Last week, code-security firm Cigital, for example, released details of two security services that allow companies to check their code for security flaws using either static or dynamic analysis. Veracode and Cenzic are two other firms that have offered similar services. The services range from a simple automated scan of a Web application to additional consulting services to explain the results and help developers close the security holes.

"You have to worry about not just testing, but fixing," says Chris Wysopal, chief technology officer for Veracode. "It is very difficult to find skilled application security people. That's one reason why going to a service provider scales better."

[A network scanner that can survey the Internet in less than an hour will make it easier for research groups to expose vulnerabilities on the Internet. See Fast Scanning To Fuel 'Golden Age' Of Global Flaw Finding.]

When looking for an application assessment service, companies should consider what vulnerabilities the service can detect. The OWASP Top-10 list of Web application vulnerabilities and SANS Top 25 Most Dangerous Software Errors are good starting points, but companies should look for deeper scans as well. In addition, the service should recommend strategies for fixing the problems and methods of avoiding the issues in the future, says Bala Venkat, chief marketing officer for Cenzic, a software security firm.

"You really need to have a metric showing the level of security or the level of vulnerability that the application has," he says. "You can track that and tell them why they have that score and how they go about addressing those vulnerabilities."

Companies also need to ask questions about how far the software-analysis service can scale, and whether the turnaround time on tests satisfy their software development life cycle, Venkat says. In addition, firms should ask the service provider how they minimize false positives.

Finally, the service's ability to give clients the benefit of their security expertise is key. Most services have a number of levels: a basic cloud service that includes an automated application scan, and more involved services, which include meetings with the developers to explain the vulnerabilities and teach them how to avoid such mistakes in the future.

"The offering has to be based on the risk profile of the customer," Cigital's Mizelle says. "You don't want to be overpaying for something that you are not going to use."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
marktroester
50%
50%
marktroester,
User Rank: Apprentice
9/30/2013 | 5:03:02 PM
re: Lack Of Security Expertise? App-Analysis Services Could Help
The other thing to consider is how applications are developed today - most are constructed using open source components using agile methodologies. To keep up with today's development pace, application security has to fit well into this model, or there will likely be resistance from developers. If the security team can provide information to the developers in the tools that they use - up front in the development process - they are more likely to have success. OWASP has recognized the need for managing components effectively by updating the specification to include A9, which addresses the use of vulnerable components.

And one way to help with the lack of expertise is to automate the work - and I'm not talking about automation of vulnerability identification - I'm talking about automation of policies that help guide developers early in the process, and automation of policies that stop applications from being promoted to production if they don't meet your policies.

Thanks,

Mark Troester

Sonatype

@mtroester
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Intel Issues Fix for 'Plundervolt' SGX Flaw
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5252
PUBLISHED: 2019-12-14
There is an improper authentication vulnerability in Huawei smartphones (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro). The applock does not perform a sufficient authentication in a rare condition. Successful exploit could allow the attacker to use the application locked by applock in an instant.
CVE-2019-5235
PUBLISHED: 2019-12-14
Some Huawei smart phones have a null pointer dereference vulnerability. An attacker crafts specific packets and sends to the affected product to exploit this vulnerability. Successful exploitation may cause the affected phone to be abnormal.
CVE-2019-5264
PUBLISHED: 2019-12-13
There is an information disclosure vulnerability in certain Huawei smartphones (Mate 10;Mate 10 Pro;Honor V10;Changxiang 7S;P-smart;Changxiang 8 Plus;Y9 2018;Honor 9 Lite;Honor 9i;Mate 9). The software does not properly handle certain information of applications locked by applock in a rare condition...
CVE-2019-5277
PUBLISHED: 2019-12-13
Huawei CloudUSM-EUA V600R006C10;V600R019C00 have an information leak vulnerability. Due to improper configuration, the attacker may cause information leak by successful exploitation.
CVE-2019-5254
PUBLISHED: 2019-12-13
Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981) have an out-of-bounds read vulnerability. An attacker who logs in to the board m...