This is a weekly post where we address questions of interest to the Application Information Security Community. To that end, we’d love to hear your questions! Please Tweet us with the hashtag #ThinkAppSec and we’ll pick a few questions to answer.

This week, I got some questions from our marketing team for a project they are working on – so I used them as a jumping off point.

1. How do we secure application vulnerabilities and code development, particularly for mobile and social applications that are built by business units or reside on the cloud?

You need to follow a comprehensive and integrated approach to manage these issues. Most companies choose application security testing technologies to detect Web vulnerabilities, and rely on mobile security solutions to supplement their application testing technologies.

But don’t forget that mobile applications that you build can be tested statically before launch and mobile applications that are purchased can be tested with dynamic tools.

Applications in the cloud can be tested in a few ways. If you’re building the apps yourself, perform the same kinds of security testing on them as you do for apps that you run on your own infrastructure.

Using apps from a provider in the cloud? Talk to them about their policies and testing procedures. And ask if they’ve performed testing or certification against any (or all!) of these standards:

2. As a CISO, how can I control my organization’s testing methodologies, change management and deployment processes, without compromising on quality and project timelines?

Our recommendation is that you incorporate security into the development process as early as possible. And take a fresh look at the traditional project management Iron Triangle, – it’s not about faster, cheaper, better/more secure – Pick Two – anymore. Managing application development securely, includes balancing business and security needs in a way that makes the most sense for your company and customers.

Previous Weeks

Week 1- What is the importance of software security in supply chain management?

Week 2 – Who Should be Responsible for Application Security Testing?

Week 2 – Can “generated code” be tested?

Submit your questions via Twitter using #ThinkAppSec

more from Application Security

Why Your Success Depends on Your IAM Capability

It’s truly universal: if you require your workforce, customers, patients, citizens, constituents, students, teachers… anyone, to register before digitally accessing information or buying goods or services, you are enabling that interaction with identity and access management (IAM). Many IAM vendors talk about how IAM solutions can be an enabler for productivity, about the return on investment (ROI) that can be…

Controlling the Source: Abusing Source Code Management Systems

For full details on this research, see the X-Force Red whitepaper “Controlling the Source: Abusing Source Code Management Systems”. This material is also being presented at Black Hat USA 2022. Source Code Management (SCM) systems play a vital role within organizations and have been an afterthought in terms of defenses compared to other critical enterprise systems such as Active Directory.…