Mapping the Application Security Terrain - Part One

The number and type of protection measures for these applications is growing. The selection of an appropriate application security risk management solution should take into account the business's diverse requirements and factors. There is no single solution that will fit every company's needs.

Those responsible for the security of their environments need to understand what risks are present in their applications, as each vulnerability has an associated criticality that is based on various factors. Armed with this knowledge, an appropriate risk management strategy can be developed with prioritized action to reduce these threats.

AsTech Consulting has over 10 years of experience assessing internet applications using manual and automated methods for both 'white box' and 'black box' assessments. We have developed a range of service levels utilizing these methods to match our customers' business needs and security requirements.

So what is the required level of application security assessment?

As enterprise application security requirements are considered, it is useful to put them in the same context as various other software attributes that we usually deal with:

Functionality
Usability
Performance
Reliabilityr
Security

However, we can't deal with the characteristics of our applications in isolation; we consider them in the context of business requirements and real world business factors including feasibility, funding, return on investment, and opportunity cost.

While better is always desirable, we can't evaluate what is better without understanding the status quo. We need to answer the "better than what?" question. This requires sufficient analysis/assessment to identify a comparative baseline.

For example: A company's web-facing newsletter sign-up page is found to have a cross-site scripting vulnerability. Addressing this risk may require $20,000 in development costs. Is this the best use of funds for this company?

In theoretical terms we want absolute safety. In practical terms we want a "reasonable or better" level of security. The definition of "reasonable" is only meaningful within the context of a specific application and business. The definition may be based upon government (e.g. DOD levels of classification), industry group requirements (Payment Card Industry), and business domain.

The very act of measuring security, performance, or reliability has an associated variable cost based upon the precision and thoroughness of the analysis, the skills of the analysts, etc.

An application security assessment process is the method of identifying application security vulnerabilities so that the business can make informed risk management decisions that include the evaluation of the financial and opportunity costs associated with mitigating the identified security risks. The thoroughness, depth, and cost of an application security assessment process should reasonably vary with business requirements.

Stay tuned for part two, where we'll look at what types of security risk to consider.