December 12, 2017 By Aubre Andrus 3 min read

Bugsy the Hare was always an overconfident gal. Sick of hearing her brag about her work to other developers, Shelldon the Tortoise challenged her to a race: Whoever built the best mobile app would win.

To win the competition, the developers had to consider both application security and functionality. Whoever’s app was rated most highly on the forest animals’ app store by the end of the month would be proclaimed the winner. The mobile app was considered mission-critical to all of the forest animals, since it would be utilized to help them easily locate food during the lean winter months.

The Race Is On

Bugsy threw something together and published it to the app store straight away. As far as app security, she decided to simply hope and pray, a strategy based on the false assumption that everything would work out fine. At some point within the following six months, she planned to do the bare minimum by running a single penetration test.

“Ha, ha, ha — I’ve got this in the bag!” she foolishly thought prior to settling down for a long autumn nap. She even bragged about her action plan to Shelldon, who moved at, well, a turtle’s pace.

When Shelldon finally made it back to his lagoon, he was feeling a little anxious because his application wasn’t completed and he was planning to spend a few days incorporating security best practices prior to the app’s release. It was going to take much longer for him to launch his application than Bugsy, but he felt more confident about his potential end results. “Slow and steady, slow and steady,” he reminded himself when his nerves got the best of him.

Don’t Sleep on Application Security Testing

Meanwhile, after a week that was punctuated by numerous lengthy siestas, Bugsy learned that her app required an urgent security update. She pushed the update through within hours, without incorporating appropriate application security testing principles. Fraudsters were already breaking in at that point. She doubled down by adopting an ad hoc daily firefighting approach to try to keep the growing number of attackers out. She then performed yet another quick fix and then took her customary long nap.

But when Bugsy awoke, another disaster struck. This time, she had to work all night to fight off the fires. “Just get through tomorrow,” she muttered to herself as her eyes began to close. It was her only feasible goal. It was no surprise when she began receiving negative app store reviews. Users were experiencing issues with her app’s functionality and realizing their sensitive information was at risk.

Slow and Steady

Back at the lagoon, Shelldon finally finished building his app. He conducted a series of security tests to make sure it was safe. Such testing wasn’t actually required, but he knew better. After all, long-term user protection was his primary goal. He even found a few vulnerabilities and fixed them before the app went live.

Once everything in his application came back clean, he published it to the app store. Shelldon’s app was released a full two weeks behind Bugsy’s, leaving Shelldon limited time to generate downloads and positive reviews. Could he possibly win in such a short time? Well, it didn’t take long for the great comments to roll in. The forest animals loved it! They would have no problem locating food this winter.

By the end of the month, Bugsy continued to receive some scathing app store reviews — along with a lot of bad press — for her foray into insecure applications. Shelldon’s positive reviews kept rolling in for his safe and well-functioning application. He generated tons of user downloads! Every animal in the forest preferred Sheldon’s app over Bugsy’s. It was clear who the real winner was.

Learn More

Despite rush-to-release pressure, developers should always heed IBM Security’s advice and build security into their mission-critical applications from the start. Remember, slow and steady wins the application security testing race.

To learn more about how you can adopt Shelldon’s wise and methodical approach to incorporate application security testing protection from the onset of your development life cycle, download our complimentary risk management e-guide now.

Read the e-guide: Five Steps to Achieve Risk-based Application Security Management

More from Topics

Brands are changing cybersecurity strategies due to AI threats

3 min read -  Over the past 18 months, AI has changed how we do many things in our work and professional lives — from helping us write emails to affecting how we approach cybersecurity. A recent Voice of SecOps 2024 study found that AI was a huge reason for many shifts in cybersecurity over the past 12 months. Interestingly, AI was both the cause of new issues as well as quickly becoming a common solution for those very same challenges.The study was conducted…

39% of MSPs report major setbacks when adapting to advanced security technologies

4 min read - SOPHOS, a leading global provider of managed security solutions, has recently released its annual MSP Perspectives report for 2024. This most recent report provides insights from 350 different managed service providers (MSPs) across the United States, United Kingdom, Germany and Australia on modern cybersecurity tools solutions. It also documents newly discovered risks and challenges in the industry.Among the many findings of this most recent report, one of the most concerning trends is the difficulties MSPs face when adapting their service…

Digital solidarity vs. digital sovereignty: Which side are you on?

4 min read - The landscape of international cyber policy continues to evolve rapidly, reflecting the dynamic nature of technology and global geopolitics. Central to this evolution are two competing concepts: digital solidarity and digital sovereignty.The U.S. Department of State, through its newly released International Cyberspace and Digital Policy Strategy, has articulated a clear preference for digital solidarity, positioning it as a counterpoint to the protectionist approach of digital sovereignty.What are the main differences between these two concepts, and why does it matter? Let’s…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today