Bugsy the Hare was always an overconfident gal. Sick of hearing her brag about her work to other developers, Shelldon the Tortoise challenged her to a race: Whoever built the best mobile app would win.

To win the competition, the developers had to consider both application security and functionality. Whoever’s app was rated most highly on the forest animals’ app store by the end of the month would be proclaimed the winner. The mobile app was considered mission-critical to all of the forest animals, since it would be utilized to help them easily locate food during the lean winter months.

The Race Is On

Bugsy threw something together and published it to the app store straight away. As far as app security, she decided to simply hope and pray, a strategy based on the false assumption that everything would work out fine. At some point within the following six months, she planned to do the bare minimum by running a single penetration test.

“Ha, ha, ha — I’ve got this in the bag!” she foolishly thought prior to settling down for a long autumn nap. She even bragged about her action plan to Shelldon, who moved at, well, a turtle’s pace.

When Shelldon finally made it back to his lagoon, he was feeling a little anxious because his application wasn’t completed and he was planning to spend a few days incorporating security best practices prior to the app’s release. It was going to take much longer for him to launch his application than Bugsy, but he felt more confident about his potential end results. “Slow and steady, slow and steady,” he reminded himself when his nerves got the best of him.

Don’t Sleep on Application Security Testing

Meanwhile, after a week that was punctuated by numerous lengthy siestas, Bugsy learned that her app required an urgent security update. She pushed the update through within hours, without incorporating appropriate application security testing principles. Fraudsters were already breaking in at that point. She doubled down by adopting an ad hoc daily firefighting approach to try to keep the growing number of attackers out. She then performed yet another quick fix and then took her customary long nap.

But when Bugsy awoke, another disaster struck. This time, she had to work all night to fight off the fires. “Just get through tomorrow,” she muttered to herself as her eyes began to close. It was her only feasible goal. It was no surprise when she began receiving negative app store reviews. Users were experiencing issues with her app’s functionality and realizing their sensitive information was at risk.

Slow and Steady

Back at the lagoon, Shelldon finally finished building his app. He conducted a series of security tests to make sure it was safe. Such testing wasn’t actually required, but he knew better. After all, long-term user protection was his primary goal. He even found a few vulnerabilities and fixed them before the app went live.

Once everything in his application came back clean, he published it to the app store. Shelldon’s app was released a full two weeks behind Bugsy’s, leaving Shelldon limited time to generate downloads and positive reviews. Could he possibly win in such a short time? Well, it didn’t take long for the great comments to roll in. The forest animals loved it! They would have no problem locating food this winter.

By the end of the month, Bugsy continued to receive some scathing app store reviews — along with a lot of bad press — for her foray into insecure applications. Shelldon’s positive reviews kept rolling in for his safe and well-functioning application. He generated tons of user downloads! Every animal in the forest preferred Sheldon’s app over Bugsy’s. It was clear who the real winner was.

Learn More

Despite rush-to-release pressure, developers should always heed IBM Security’s advice and build security into their mission-critical applications from the start. Remember, slow and steady wins the application security testing race.

To learn more about how you can adopt Shelldon’s wise and methodical approach to incorporate application security testing protection from the onset of your development life cycle, download our complimentary risk management e-guide now.

Read the e-guide: Five Steps to Achieve Risk-based Application Security Management