Bugsy the Hare was always an overconfident gal. Sick of hearing her brag about her work to other developers, Shelldon the Tortoise challenged her to a race: Whoever built the best mobile app would win.

To win the competition, the developers had to consider both application security and functionality. Whoever’s app was rated most highly on the forest animals’ app store by the end of the month would be proclaimed the winner. The mobile app was considered mission-critical to all of the forest animals, since it would be utilized to help them easily locate food during the lean winter months.

The Race Is On

Bugsy threw something together and published it to the app store straight away. As far as app security, she decided to simply hope and pray, a strategy based on the false assumption that everything would work out fine. At some point within the following six months, she planned to do the bare minimum by running a single penetration test.

“Ha, ha, ha — I’ve got this in the bag!” she foolishly thought prior to settling down for a long autumn nap. She even bragged about her action plan to Shelldon, who moved at, well, a turtle’s pace.

When Shelldon finally made it back to his lagoon, he was feeling a little anxious because his application wasn’t completed and he was planning to spend a few days incorporating security best practices prior to the app’s release. It was going to take much longer for him to launch his application than Bugsy, but he felt more confident about his potential end results. “Slow and steady, slow and steady,” he reminded himself when his nerves got the best of him.

Don’t Sleep on Application Security Testing

Meanwhile, after a week that was punctuated by numerous lengthy siestas, Bugsy learned that her app required an urgent security update. She pushed the update through within hours, without incorporating appropriate application security testing principles. Fraudsters were already breaking in at that point. She doubled down by adopting an ad hoc daily firefighting approach to try to keep the growing number of attackers out. She then performed yet another quick fix and then took her customary long nap.

But when Bugsy awoke, another disaster struck. This time, she had to work all night to fight off the fires. “Just get through tomorrow,” she muttered to herself as her eyes began to close. It was her only feasible goal. It was no surprise when she began receiving negative app store reviews. Users were experiencing issues with her app’s functionality and realizing their sensitive information was at risk.

Slow and Steady

Back at the lagoon, Shelldon finally finished building his app. He conducted a series of security tests to make sure it was safe. Such testing wasn’t actually required, but he knew better. After all, long-term user protection was his primary goal. He even found a few vulnerabilities and fixed them before the app went live.

Once everything in his application came back clean, he published it to the app store. Shelldon’s app was released a full two weeks behind Bugsy’s, leaving Shelldon limited time to generate downloads and positive reviews. Could he possibly win in such a short time? Well, it didn’t take long for the great comments to roll in. The forest animals loved it! They would have no problem locating food this winter.

By the end of the month, Bugsy continued to receive some scathing app store reviews — along with a lot of bad press — for her foray into insecure applications. Shelldon’s positive reviews kept rolling in for his safe and well-functioning application. He generated tons of user downloads! Every animal in the forest preferred Sheldon’s app over Bugsy’s. It was clear who the real winner was.

Learn More

Despite rush-to-release pressure, developers should always heed IBM Security’s advice and build security into their mission-critical applications from the start. Remember, slow and steady wins the application security testing race.

To learn more about how you can adopt Shelldon’s wise and methodical approach to incorporate application security testing protection from the onset of your development life cycle, download our complimentary risk management e-guide now.

Read the e-guide: Five Steps to Achieve Risk-based Application Security Management

More from Application Security

Patch Tuesday -> Exploit Wednesday: Pwning Windows Ancillary Function Driver for WinSock (afd.sys) in 24 Hours

‘Patch Tuesday, Exploit Wednesday’ is an old hacker adage that refers to the weaponization of vulnerabilities the day after monthly security patches become publicly available. As security improves and exploit mitigations become more sophisticated, the amount of research and development required to craft a weaponized exploit has increased. This is especially relevant for memory corruption vulnerabilities.Figure 1 — Exploitation timelineHowever, with the addition of new features (and memory-unsafe C code) in the Windows 11 kernel, ripe new attack surfaces can…

Backdoor Deployment and Ransomware: Top Threats Identified in X-Force Threat Intelligence Index 2023

Deployment of backdoors was the number one action on objective taken by threat actors last year, according to the 2023 IBM Security X-Force Threat Intelligence Index — a comprehensive analysis of our research data collected throughout the year. Backdoor access is now among the hottest commodities on the dark web and can sell for thousands of dollars, compared to credit card data — which can go for as low as $10. On the dark web — a veritable eBay for…

Direct Kernel Object Manipulation (DKOM) Attacks on ETW Providers

Overview In this post, IBM Security X-Force Red offensive hackers analyze how attackers, with elevated privileges, can use their access to stage Windows Kernel post-exploitation capabilities. Over the last few years, public accounts have increasingly shown that less sophisticated attackers are using this technique to achieve their objectives. It is therefore important that we put a spotlight on this capability and learn more about its potential impact. Specifically, in this post, we will evaluate how Kernel post-exploitation can be used…

Detecting the Undetected: The Risk to Your Info

IBM’s Advanced Threat Detection and Response Team (ATDR) has seen an increase in the malware family known as information stealers in the wild over the past year. Info stealers are malware with the capability of scanning for and exfiltrating data and credentials from your device. When executed, they begin scanning for and copying various directories that usually contain some sort of sensitive information or credentials including web and login data from Chrome, Firefox, and Microsoft Edge. In other instances, they…