December 12, 2017 By Aubre Andrus 3 min read

Bugsy the Hare was always an overconfident gal. Sick of hearing her brag about her work to other developers, Shelldon the Tortoise challenged her to a race: Whoever built the best mobile app would win.

To win the competition, the developers had to consider both application security and functionality. Whoever’s app was rated most highly on the forest animals’ app store by the end of the month would be proclaimed the winner. The mobile app was considered mission-critical to all of the forest animals, since it would be utilized to help them easily locate food during the lean winter months.

The Race Is On

Bugsy threw something together and published it to the app store straight away. As far as app security, she decided to simply hope and pray, a strategy based on the false assumption that everything would work out fine. At some point within the following six months, she planned to do the bare minimum by running a single penetration test.

“Ha, ha, ha — I’ve got this in the bag!” she foolishly thought prior to settling down for a long autumn nap. She even bragged about her action plan to Shelldon, who moved at, well, a turtle’s pace.

When Shelldon finally made it back to his lagoon, he was feeling a little anxious because his application wasn’t completed and he was planning to spend a few days incorporating security best practices prior to the app’s release. It was going to take much longer for him to launch his application than Bugsy, but he felt more confident about his potential end results. “Slow and steady, slow and steady,” he reminded himself when his nerves got the best of him.

Don’t Sleep on Application Security Testing

Meanwhile, after a week that was punctuated by numerous lengthy siestas, Bugsy learned that her app required an urgent security update. She pushed the update through within hours, without incorporating appropriate application security testing principles. Fraudsters were already breaking in at that point. She doubled down by adopting an ad hoc daily firefighting approach to try to keep the growing number of attackers out. She then performed yet another quick fix and then took her customary long nap.

But when Bugsy awoke, another disaster struck. This time, she had to work all night to fight off the fires. “Just get through tomorrow,” she muttered to herself as her eyes began to close. It was her only feasible goal. It was no surprise when she began receiving negative app store reviews. Users were experiencing issues with her app’s functionality and realizing their sensitive information was at risk.

Slow and Steady

Back at the lagoon, Shelldon finally finished building his app. He conducted a series of security tests to make sure it was safe. Such testing wasn’t actually required, but he knew better. After all, long-term user protection was his primary goal. He even found a few vulnerabilities and fixed them before the app went live.

Once everything in his application came back clean, he published it to the app store. Shelldon’s app was released a full two weeks behind Bugsy’s, leaving Shelldon limited time to generate downloads and positive reviews. Could he possibly win in such a short time? Well, it didn’t take long for the great comments to roll in. The forest animals loved it! They would have no problem locating food this winter.

By the end of the month, Bugsy continued to receive some scathing app store reviews — along with a lot of bad press — for her foray into insecure applications. Shelldon’s positive reviews kept rolling in for his safe and well-functioning application. He generated tons of user downloads! Every animal in the forest preferred Sheldon’s app over Bugsy’s. It was clear who the real winner was.

Learn More

Despite rush-to-release pressure, developers should always heed IBM Security’s advice and build security into their mission-critical applications from the start. Remember, slow and steady wins the application security testing race.

To learn more about how you can adopt Shelldon’s wise and methodical approach to incorporate application security testing protection from the onset of your development life cycle, download our complimentary risk management e-guide now.

Read the e-guide: Five Steps to Achieve Risk-based Application Security Management

More from Topics

How I got started: Incident responder

3 min read - As a cybersecurity incident responder, life can go from chill to chaos in seconds. What is it about being an incident responder that makes people want to step up for this crucial cybersecurity role?With our How I Got Started series, we learn from experts in their field and find out how they got started and what advice they have for anyone looking to get into the field.In this Q&A, we spoke with IBM’s own Dave Bales, co-lead X-Force Incident Command…

How TikTok is reframing cybersecurity efforts

4 min read - You might think of TikTok as the place to go to find out new recipes and laugh at silly videos. And as a cybersecurity professional, TikTok’s potential data security issues are also likely to come to mind. However, in recent years, TikTok has worked to promote cybersecurity through its channels and programs. To highlight its efforts, TikTok celebrated Cybersecurity Month by promoting its cybersecurity focus and sharing cybersecurity TikTok creators.Global Bug Bounty program with HackerOneDuring Cybersecurity Month, the social media…

Roundup: The top ransomware stories of 2024

2 min read - The year 2024 saw a marked increase in the competence, aggression and unpredictability of ransomware attackers. Nearly all the key numbers are up — more ransomware gangs, bigger targets and higher payouts. Malicious ransomware groups also focus on critical infrastructure and supply chains, raising the stakes for victims and increasing the motivation to cooperate.Here are the biggest ransomware stories of 2024.Ransomware payments reach record highRansomware payments surged to record highs in 2024. In the first half of the year, victims…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today