One would think that software would be secure if companies are offering it to users. Why do so many applications have vulnerabilities?
Requires Free Membership to View
When you register, you'll receive targeted emails designed to keep you informed of the most relevant information on Agile development, application security, testing & QA, software requirements, and more.
Hannah Smalltree, Editorial Director
Every application vulnerability is the result of some error during the development of the application. These errors can be organized into three key areas: insufficient processes or practices, inadequate skills or teams and incomplete supporting technology. Note that while application security technologies are critical to an organization's application security efforts, they must be paired with the right set of team and process improvements.
The most common issues in the process area are the failure to define clear and detailed security requirements, lack of threat modeling activities and failure to perform security testing and analysis. In the skills and team area, many developers have not been trained in secure coding, and very few organizations have created an application security team to support development projects. Finally, organizations need supporting tools and technologies to identify and diagnose vulnerabilities as well as standard libraries that implement security functions.
The most common issues in the process area are the failure to define clear and detailed security requirements, lack of threat modeling activities and failure to perform security testing and analysis. In the skills and team area, many developers have not been trained in secure coding, and very few organizations have created an application security team to support development projects. Finally, organizations need supporting tools and technologies to identify and diagnose vulnerabilities as well as standard libraries that implement security functions.
This was first published in January 2006