This is a weekly post where we address questions of interest to the Application Information Security Community. To that end, we’d love to hear your questions! Please Tweet us with the hashtag #ThinkAppSec or leave us a comment below and we’ll pick one or two questions from that list.
I had the good fortune to meet with financial services customers and potential customers in Spain this week. These questions were inspired by those discussions.
1. Who Should be Responsible for Application Security Testing?
As with many security questions the ultimate answer depends on the company in question: what are their specific needs? Budget? Skill sets? But some high level general rules of thumb:
- At some levels, application security testing is the responsibility of everyone involved in the software development lifecycle from the CEO to the Development team
- Exec Manage should have buy-in and support security activities
- Business and App Owners should get involved in the security requirements definition and understand associated risks
- Developers should be trained on secure coding techniques and have access to testing tools
- Architects should understand principles of secure design and consider providing libraries and components that help developers achieve more secure software
- Security and audit often have testing responsibilities prior to launch for both static and dynamic tests
What else? Who is responsible for app sec testing at your company? And why? And would you like to see the responsibility change in anyway? Let us know in the comments or using the #thinkappsec hashtag on Twitter.
2. Can “generated code” be tested?
If generated code is in a format and language that the tool can scan, then yes it should be testable with application security testing tools.
However, since it’s generated it may be harder to fix the vulnerability, for example if a component from a vendor generates buggy code, the dev or security team would need to go back to the vendor to have the component updated.
Are you using component based development in your shops? How do you test those apps?
Week 1- What is the importance of software security in supply chain management?
Executive Security Advisor, IBM Security