This is a weekly post where we address questions of interest to the Application Information Security Community. To that end, we’d love to hear your questions! Please Tweet us with the hashtag #ThinkAppSec and we’ll pick a few questions to answer.

This week, I got some questions from our marketing team for a project they are working on – so I used them as a jumping off point.

1. How do we secure application vulnerabilities and code development, particularly for mobile and social applications that are built by business units or reside on the cloud?

You need to follow a comprehensive and integrated approach to manage these issues. Most companies choose application security testing technologies to detect Web vulnerabilities, and rely on mobile security solutions to supplement their application testing technologies.

But don’t forget that mobile applications that you build can be tested statically before launch and mobile applications that are purchased can be tested with dynamic tools.

Applications in the cloud can be tested in a few ways. If you’re building the apps yourself, perform the same kinds of security testing on them as you do for apps that you run on your own infrastructure.

Using apps from a provider in the cloud? Talk to them about their policies and testing procedures. And ask if they’ve performed testing or certification against any (or all!) of these standards:

• CSA STAR (Security, Trust and Assurance Registry)
• AICPA Statements on Standards for Attestation Engagements (SSAE 16) and Service Organization Control (SOC) Reports
• Payment Card Industry Data Security Standard (PCI-DSS) and the PCI Cloud Guidelines
• ISO/IEC 27034-1:2011

2. As a CISO, how can I control my organization’s testing methodologies, change management and deployment processes, without compromising on quality and project timelines?

Our recommendation is that you incorporate security into the development process as early as possible. And take a fresh look at the traditional project management Iron Triangle, – it’s not about faster, cheaper, better/more secure – Pick Two – anymore. Managing application development securely, includes balancing business and security needs in a way that makes the most sense for your company and customers.

Previous Weeks

Week 1- What is the importance of software security in supply chain management?

Week 2 – Who Should be Responsible for Application Security Testing?

Week 2 – Can “generated code” be tested?

Submit your questions via Twitter using #ThinkAppSec

Tweet #ThinkAppSec