How Can I Secure Apps in the Cloud?

This is a weekly post where we address questions of interest to the Application Information Security Community. To that end, we’d love to hear your questions! Please Tweet us with the hashtag #ThinkAppSec and we’ll pick a few questions to answer.

This week, I got some questions from our marketing team for a project they are working on – so I used them as a jumping off point.

1. How do we secure application vulnerabilities and code development, particularly for mobile and social applications that are built by business units or reside on the cloud?

You need to follow a comprehensive and integrated approach to manage these issues. Most companies choose application security testing technologies to detect Web vulnerabilities, and rely on mobile security solutions to supplement their application testing technologies.

But don’t forget that mobile applications that you build can be tested statically before launch and mobile applications that are purchased can be tested with dynamic tools.

Applications in the cloud can be tested in a few ways. If you’re building the apps yourself, perform the same kinds of security testing on them as you do for apps that you run on your own infrastructure.

Using apps from a provider in the cloud? Talk to them about their policies and testing procedures. And ask if they’ve performed testing or certification against any (or all!) of these standards:

2. As a CISO, how can I control my organization’s testing methodologies, change management and deployment processes, without compromising on quality and project timelines?

Our recommendation is that you incorporate security into the development process as early as possible. And take a fresh look at the traditional project management Iron Triangle, – it’s not about faster, cheaper, better/more secure – Pick Two – anymore. Managing application development securely, includes balancing business and security needs in a way that makes the most sense for your company and customers.

Previous Weeks

Week 1- What is the importance of software security in supply chain management?

Week 2 – Who Should be Responsible for Application Security Testing?

Week 2 – Can “generated code” be tested?

Submit your questions via Twitter using #ThinkAppSec

Tweet #ThinkAppSec

Diana Kelley

Executive Security Advisor, IBM Security

PixPirate: The Brazilian financial malware you can’t see

10 min read - Malicious software always aims to stay hidden, making itself invisible so the victims can’t detect it. The constantly mutating PixPirate malware has taken that strategy to a new extreme. PixPirate is a sophisticated financial remote access trojan (RAT) malware that heavily utilizes anti-research techniques. This malware’s infection vector is based on two malicious apps: a downloader and a droppee. Operating together, these two apps communicate with each other to execute the fraud. So far, IBM Trusteer researchers have observed this…

From federation to fabric: IAM’s evolution

15 min read - In the modern day, we’ve come to expect that our various applications can share our identity information with one another. Most of our core systems federate seamlessly and bi-directionally. This means that you can quite easily register and log in to a given service with the user account from another service or even invert that process (technically possible, not always advisable). But what is the next step in our evolution towards greater interoperability between our applications, services and systems?Identity and…

Audio-jacking: Using generative AI to distort live audio transactions

7 min read - The rise of generative AI, including text-to-image, text-to-speech and large language models (LLMs), has significantly changed our work and personal lives. While these advancements offer many benefits, they have also presented new challenges and risks. Specifically, there has been an increase in threat actors who attempt to exploit large language models to create phishing emails and use generative AI, like fake voices, to scam people. We recently published research showcasing how adversaries could hypnotize LLMs to serve nefarious purposes simply…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

1. How do we secure application vulnerabilities and code development, particularly for mobile and social applications that are built by business units or reside on the cloud?

2. As a CISO, how can I control my organization’s testing methodologies, change management and deployment processes, without compromising on quality and project timelines?

Previous Weeks

More from Application Security

PixPirate: The Brazilian financial malware you can’t see

From federation to fabric: IAM’s evolution

Audio-jacking: Using generative AI to distort live audio transactions

Topic updates