Who Should be Responsible for Application Security Testing?

This is a weekly post where we address questions of interest to the Application Information Security Community. To that end, we’d love to hear your questions! Please Tweet us with the hashtag #ThinkAppSec or leave us a comment below and we’ll pick one or two questions from that list.

I had the good fortune to meet with financial services customers and potential customers in Spain this week. These questions were inspired by those discussions.

1. Who Should be Responsible for Application Security Testing?

As with many security questions the ultimate answer depends on the company in question: what are their specific needs? Budget? Skill sets? But some high level general rules of thumb:

At some levels, application security testing is the responsibility of everyone involved in the software development lifecycle from the CEO to the Development team
Exec Manage should have buy-in and support security activities
Business and App Owners should get involved in the security requirements definition and understand associated risks
Developers should be trained on secure coding techniques and have access to testing tools
Architects should understand principles of secure design and consider providing libraries and components that help developers achieve more secure software
Security and audit often have testing responsibilities prior to launch for both static and dynamic tests

What else? Who is responsible for app sec testing at your company? And why? And would you like to see the responsibility change in anyway? Let us know in the comments or using the #thinkappsec hashtag on Twitter.

Tweet #ThinkAppSec

2. Can “generated code” be tested?

If generated code is in a format and language that the tool can scan, then yes it should be testable with application security testing tools.

However, since it’s generated it may be harder to fix the vulnerability, for example if a component from a vendor generates buggy code, the dev or security team would need to go back to the vendor to have the component updated.

Are you using component based development in your shops? How do you test those apps?

Week 1- What is the importance of software security in supply chain management?

Diana Kelley

Executive Security Advisor, IBM Security

Critically close to zero(day): Exploiting Microsoft Kernel streaming service

10 min read - Last month Microsoft patched a vulnerability in the Microsoft Kernel Streaming Server, a Windows kernel component used in the virtualization and sharing of camera devices. The vulnerability, CVE-2023-36802, allows a local attacker to escalate privileges to SYSTEM. This blog post details my process of exploring a new attack surface in the Windows kernel, finding a 0-day vulnerability, exploring an interesting bug class, and building a stable exploit. This post doesn’t require any specialized Windows kernel knowledge to follow along, though…

Gozi strikes again, targeting banks, cryptocurrency and more

3 min read - In the world of cybercrime, malware plays a prominent role. One such malware, Gozi, emerged in 2006 as Gozi CRM, also known as CRM or Papras. Initially offered as a crime-as-a-service (CaaS) platform called 76Service, Gozi quickly gained notoriety for its advanced capabilities. Over time, Gozi underwent a significant transformation and became associated with other malware strains, such as Ursnif (Snifula) and Vawtrak/Neverquest. Now, in a recent campaign, Gozi has set its sights on banks, financial services and cryptocurrency platforms,…

Vulnerability management, its impact and threat modeling methodologies

7 min read - Vulnerability management is a security practice designed to avoid events that could potentially harm an organization. It is a regular ongoing process that identifies, assesses, and manages vulnerabilities across all the components of an IT ecosystem. Cybersecurity is one of the major priorities many organizations struggle to stay on top of. There is a huge increase in the number of cyberattacks carried out by cybercriminals to steal valuable information from businesses. Hence to encounter these attacks, organizations are now focusing…

X-Force releases detection & response framework for managed file transfer software

5 min read - How AI can help defenders scale detection guidance for enterprise software tools If we look back at mass exploitation events that shook the security industry like Log4j, Atlassian, and Microsoft Exchange when these solutions were actively being exploited by attackers, the exploits may have been associated with a different CVE, but the detection and response guidance being released by the various security vendors had many similarities (e.g., Log4shell vs. Log4j2 vs. MOVEit vs. Spring4Shell vs. Microsoft Exchange vs. ProxyShell vs.…

Security Intelligence

{{title}}

{{title}}

{{title}}

{{title}}

Topics

1. Who Should be Responsible for Application Security Testing?

2. Can “generated code” be tested?

More from Application Security

Critically close to zero(day): Exploiting Microsoft Kernel streaming service

Gozi strikes again, targeting banks, cryptocurrency and more

Vulnerability management, its impact and threat modeling methodologies

X-Force releases detection & response framework for managed file transfer software

Topic updates