Home > Ask the Software Quality Experts > Application Security Questions & Answers > Reason for application vulnerabilities
Ask The Software Quality Expert: Questions & Answers
EMAIL THIS

Reason for application vulnerabilities

Jeff Williams EXPERT RESPONSE FROM: Jeff Williams

Pose a Question
Other Software Quality Categories
Meet all Software Quality Experts
Become an Expert for this site


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


>
QUESTION POSED ON: 09 January 2006
One would think that software would be secure if companies are offering it to users. Why do so many applications have vulnerabilities?

>
EXPERT RESPONSE
Every application vulnerability is the result of some error during the development of the application. These errors can be organized into three key areas: insufficient processes or practices, inadequate skills or teams and incomplete supporting technology. Note that while application security technologies are critical to an organization's application security efforts, they must be paired with the right set of team and process improvements.

The most common issues in the process area are the failure to define clear and detailed security requirements, lack of threat modeling activities and failure to perform security testing and analysis. In the skills and team area, many developers have not been trained in secure coding, and very few organizations have created an application security team to support development projects. Finally, organizations need supporting tools and technologies to identify and diagnose vulnerabilities as well as standard libraries that implement security functions.


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


RELATED CONTENT
Building security into the SDLC (Software development life cycle)
How to prevent HTTP response splitting
Browser security a concern for website development
Web application security and the PCI DSS
PCI DSS compliance: Web application firewalls (WAFs)
PCI DSS compliance: The basics
PCI DSS compliance: Code review
PCI DSS compliance: WAF, code review or both?
Application security careers have bright future
Writing software requirements that address security issues
Software Security Engineering: A Guide for Project Managers -- Chapter 3, Requirements Engineering for Secure Software

Software security testing and techniques
Recipe for successful Web application security testing
Software quality needs to be a continuous process
Cloud computing's effect on application security
Web Security Testing Cookbook sample recipe
Ajax website security: Don't trust the client
PCI compliance falls short of assuring website security
Be aware of SOA application security issues
Browser security a concern for website development
Static analysis at the end of the SDLC doesn't work
Website security improved, but more can be done

Application Security
Top tools for testing Web application security
How to prevent HTTP response splitting
PCI DSS compliance: WAF, code review or both?
Application security careers have bright future
How to prevent anti-DNS pinning attacks
Open source application security testing tools
Java application security features and measures
Web application security testing basics
Password recovery with .NET 2.O using C#
Free load and performance testing tools

RELATED RESOURCES
2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
Search Bitpipe.com for the latest white papers and business webcasts
Whatis.com, the online computer dictionary



Search and Browse the Expert Answer Center
Search and browse more than 25,000 question and answer pairs from more than 250 TechTarget industry experts.
Browse our Expert Advice



Software Quality - Software Maintenance, Software Requirements, Software Standards
About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
SEARCH 
TechTarget provides enterprise IT professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective IT purchase decisions and managing their organizations' IT projects - with its network of technology-specific Web sites, events and magazines.

TechTarget Corporate Web Site  |  Media Kits  |  Reprints  |  Site Map




All Rights Reserved, Copyright 2006 - 2008, TechTarget | Read our Privacy Policy 		  TechTarget - The IT Media ROI Experts