How Can I Secure Apps in the Cloud?

This is a weekly post where we address questions of interest to the Application Information Security Community. To that end, we’d love to hear your questions! Please Tweet us with the hashtag #ThinkAppSec and we’ll pick a few questions to answer.

This week, I got some questions from our marketing team for a project they are working on – so I used them as a jumping off point.

1. How do we secure application vulnerabilities and code development, particularly for mobile and social applications that are built by business units or reside on the cloud?

You need to follow a comprehensive and integrated approach to manage these issues. Most companies choose application security testing technologies to detect Web vulnerabilities, and rely on mobile security solutions to supplement their application testing technologies.

But don’t forget that mobile applications that you build can be tested statically before launch and mobile applications that are purchased can be tested with dynamic tools.

Applications in the cloud can be tested in a few ways. If you’re building the apps yourself, perform the same kinds of security testing on them as you do for apps that you run on your own infrastructure.

Using apps from a provider in the cloud? Talk to them about their policies and testing procedures. And ask if they’ve performed testing or certification against any (or all!) of these standards:

2. As a CISO, how can I control my organization’s testing methodologies, change management and deployment processes, without compromising on quality and project timelines?

Our recommendation is that you incorporate security into the development process as early as possible. And take a fresh look at the traditional project management Iron Triangle, – it’s not about faster, cheaper, better/more secure – Pick Two – anymore. Managing application development securely, includes balancing business and security needs in a way that makes the most sense for your company and customers.

Previous Weeks

Week 1- What is the importance of software security in supply chain management?

Week 2 – Who Should be Responsible for Application Security Testing?

Week 2 – Can “generated code” be tested?

Submit your questions via Twitter using #ThinkAppSec

Tweet #ThinkAppSec

Diana Kelley

Executive Security Advisor, IBM Security

Diana Kelley is an internationally recognized information security expert, speaker, strategic advisor, market analyst and writer. She has over 20 years of IT...

Patch Tuesday -> Exploit Wednesday: Pwning Windows Ancillary Function Driver for WinSock (afd.sys) in 24 Hours

‘Patch Tuesday, Exploit Wednesday’ is an old hacker adage that refers to the weaponization of vulnerabilities the day after monthly security patches become publicly available. As security improves and exploit mitigations become more sophisticated, the amount of research and development required to craft a weaponized exploit has increased. This is especially relevant for memory corruption vulnerabilities.Figure 1 — Exploitation timelineHowever, with the addition of new features (and memory-unsafe C code) in the Windows 11 kernel, ripe new attack surfaces can…

Backdoor Deployment and Ransomware: Top Threats Identified in X-Force Threat Intelligence Index 2023

Deployment of backdoors was the number one action on objective taken by threat actors last year, according to the 2023 IBM Security X-Force Threat Intelligence Index — a comprehensive analysis of our research data collected throughout the year. Backdoor access is now among the hottest commodities on the dark web and can sell for thousands of dollars, compared to credit card data — which can go for as low as $10. On the dark web — a veritable eBay for…

Direct Kernel Object Manipulation (DKOM) Attacks on ETW Providers

Overview In this post, IBM Security X-Force Red offensive hackers analyze how attackers, with elevated privileges, can use their access to stage Windows Kernel post-exploitation capabilities. Over the last few years, public accounts have increasingly shown that less sophisticated attackers are using this technique to achieve their objectives. It is therefore important that we put a spotlight on this capability and learn more about its potential impact. Specifically, in this post, we will evaluate how Kernel post-exploitation can be used…

Detecting the Undetected: The Risk to Your Info

IBM’s Advanced Threat Detection and Response Team (ATDR) has seen an increase in the malware family known as information stealers in the wild over the past year. Info stealers are malware with the capability of scanning for and exfiltrating data and credentials from your device. When executed, they begin scanning for and copying various directories that usually contain some sort of sensitive information or credentials including web and login data from Chrome, Firefox, and Microsoft Edge. In other instances, they…

Security Intelligence

{{title}}

{{title}}

{{title}}

{{title}}

Topics

1. How do we secure application vulnerabilities and code development, particularly for mobile and social applications that are built by business units or reside on the cloud?

2. As a CISO, how can I control my organization’s testing methodologies, change management and deployment processes, without compromising on quality and project timelines?

Previous Weeks

More from Application Security

Patch Tuesday -> Exploit Wednesday: Pwning Windows Ancillary Function Driver for WinSock (afd.sys) in 24 Hours

Backdoor Deployment and Ransomware: Top Threats Identified in X-Force Threat Intelligence Index 2023

Direct Kernel Object Manipulation (DKOM) Attacks on ETW Providers

Detecting the Undetected: The Risk to Your Info