Who Should be Responsible for Application Security Testing?

This is a weekly post where we address questions of interest to the Application Information Security Community. To that end, we’d love to hear your questions! Please Tweet us with the hashtag #ThinkAppSec or leave us a comment below and we’ll pick one or two questions from that list.

I had the good fortune to meet with financial services customers and potential customers in Spain this week. These questions were inspired by those discussions.

1. Who Should be Responsible for Application Security Testing?

As with many security questions the ultimate answer depends on the company in question: what are their specific needs? Budget? Skill sets? But some high level general rules of thumb:

At some levels, application security testing is the responsibility of everyone involved in the software development lifecycle from the CEO to the Development team
Exec Manage should have buy-in and support security activities
Business and App Owners should get involved in the security requirements definition and understand associated risks
Developers should be trained on secure coding techniques and have access to testing tools
Architects should understand principles of secure design and consider providing libraries and components that help developers achieve more secure software
Security and audit often have testing responsibilities prior to launch for both static and dynamic tests

What else? Who is responsible for app sec testing at your company? And why? And would you like to see the responsibility change in anyway? Let us know in the comments or using the #thinkappsec hashtag on Twitter.

Tweet #ThinkAppSec

2. Can “generated code” be tested?

If generated code is in a format and language that the tool can scan, then yes it should be testable with application security testing tools.

However, since it’s generated it may be harder to fix the vulnerability, for example if a component from a vendor generates buggy code, the dev or security team would need to go back to the vendor to have the component updated.

Are you using component based development in your shops? How do you test those apps?

Week 1- What is the importance of software security in supply chain management?

Diana Kelley

Executive Security Advisor, IBM Security

PixPirate: The Brazilian financial malware you can’t see

10 min read - Malicious software always aims to stay hidden, making itself invisible so the victims can’t detect it. The constantly mutating PixPirate malware has taken that strategy to a new extreme. PixPirate is a sophisticated financial remote access trojan (RAT) malware that heavily utilizes anti-research techniques. This malware’s infection vector is based on two malicious apps: a downloader and a droppee. Operating together, these two apps communicate with each other to execute the fraud. So far, IBM Trusteer researchers have observed this…

From federation to fabric: IAM’s evolution

15 min read - In the modern day, we’ve come to expect that our various applications can share our identity information with one another. Most of our core systems federate seamlessly and bi-directionally. This means that you can quite easily register and log in to a given service with the user account from another service or even invert that process (technically possible, not always advisable). But what is the next step in our evolution towards greater interoperability between our applications, services and systems?Identity and…

Audio-jacking: Using generative AI to distort live audio transactions

7 min read - The rise of generative AI, including text-to-image, text-to-speech and large language models (LLMs), has significantly changed our work and personal lives. While these advancements offer many benefits, they have also presented new challenges and risks. Specifically, there has been an increase in threat actors who attempt to exploit large language models to create phishing emails and use generative AI, like fake voices, to scam people. We recently published research showcasing how adversaries could hypnotize LLMs to serve nefarious purposes simply…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

1. Who Should be Responsible for Application Security Testing?

2. Can “generated code” be tested?

More from Application Security

PixPirate: The Brazilian financial malware you can’t see

From federation to fabric: IAM’s evolution

Audio-jacking: Using generative AI to distort live audio transactions

Topic updates