This is a weekly post where we address questions of interest to the Application Information Security Community. To that end, we’d love to hear your questions! Please Tweet us with the hashtag #ThinkAppSec or leave us a comment below and we’ll pick one or two questions from that list.

I had the good fortune to meet with financial services customers and potential customers in Spain this week. These questions were inspired by those discussions.

1. Who Should be Responsible for Application Security Testing?

As with many security questions the ultimate answer depends on the company in question: what are their specific needs? Budget? Skill sets? But some high level general rules of thumb:

  • At some levels, application security testing is the responsibility of everyone involved in the software development lifecycle from the CEO to the Development team
  • Exec Manage should have buy-in and support security activities
  • Business and App Owners should get involved in the security requirements definition and understand associated risks
  • Developers should be trained on secure coding techniques and have access to testing tools
  • Architects should understand principles of secure design and consider providing libraries and components that help developers achieve more secure software
  • Security and audit often have testing responsibilities prior to launch for both static and dynamic tests

What else? Who is responsible for app sec testing at your company? And why? And would you like to see the responsibility change in anyway? Let us know in the comments or using the #thinkappsec hashtag on Twitter.


2. Can “generated code” be tested?

If generated code is in a format and language that the tool can scan, then yes it should be testable with application security testing tools.

However, since it’s generated it may be harder to fix the vulnerability, for example if a component from a vendor generates buggy code, the dev or security team would need to go back to the vendor to have the component updated.

Are you using component based development in your shops? How do you test those apps?

Week 1- What is the importance of software security in supply chain management?

more from Application Security

Why Your Success Depends on Your IAM Capability

It’s truly universal: if you require your workforce, customers, patients, citizens, constituents, students, teachers… anyone, to register before digitally accessing information or buying goods or services, you are enabling that interaction with identity and access management (IAM). Many IAM vendors talk about how IAM solutions can be an enabler for productivity, about the return on investment (ROI) that can be…

Controlling the Source: Abusing Source Code Management Systems

For full details on this research, see the X-Force Red whitepaper “Controlling the Source: Abusing Source Code Management Systems”. This material is also being presented at Black Hat USA 2022. Source Code Management (SCM) systems play a vital role within organizations and have been an afterthought in terms of defenses compared to other critical enterprise systems such as Active Directory.…