Application Security Principles

By | December 11, 2005

Consumers and businesses today have attained a certain level of trust regarding online activity and interactions. They don’t hesitate to provide financial information via their bank’s Web site, use Web applications to shop online, book flights via the Web, or access corporate Intranets to communicate sensitive internal information.

This has presented a new challenge for enterprises as they continue to build more complex applications to run their online businesses. Secure application development requires a constant balancing act between functional requirements and business drivers, deadlines and limited resources, and risk and flexibility. Success comes to organizations that build security into all phases of their application development lifecycle.

By focusing on the security risks inherent in the application development process, and the possible risks to an organization’s customers, developers can apply these principles to any programming language or technology.

Why is application security so important for enterprises in today’s business environment?

Gone are the days when security breaches could be pushed aside and dealt with behind closed doors. Security breaches of all flavors have made front-page news since the beginning of 2005—several of which can be blamed on the insecure applications rolled out by organizations to enable online activities for customers and end users.

Consider the examples. Recently, alumni at a large university were notified that personal information stored on a server used by the school for fund raising could have been exposed to intruders. Similarly, hackers also compromised databases belonging to a well known online information provider, stealing personal information on large numbers of individuals. At the same time, organizations are building more complex applications to run their online businesses, while consumers continue to entrust organization with very sensitive data.

What role does regulatory compliance play in application security?

Organizations are being forced to comply with an alphabet soup of regulations—everything from Sarbanes-Oxley (SOX) and the Health Information Portability and Accountability Act (HIPAA)—which means security is not just a business issues, but also a legal issue. The California Security Breach Information Act, for example, requires that state agencies and businesses that collect personal information from Californians promptly disclose certain types of security lapses or face harsh penalties.

Who should be concerned with application security?

Architects, developers, and project managers developing third-party applications should place emphasis on application security principles. However, vulnerabilities within custom in-house applications are more common and pose significant risk to sensitive information, such as consumers’ personal financial information.

Leave a Reply