Application Security
- Home
- Application Security
Cloud migration, microservices and container adoption are driving application modernization, but are your applications secure? Application vulnerabilities are often uncovered late because DevOps and security processes can be disjointed. Application security services professionals with a deep understanding of the software development lifecycle (SDLC) can help assess and transform your “shift-left” and DevSecOps practices.*
Application security services involves three key elements:*
Helps development, security and operations teams share skill sets for greater collaboration*
Onsite or online help to establish enterprise-grade security and software development*
In-depth analysis of app security architectures and capability against threats*
Securely build, deploy and iterate applications everywhere by transforming DevOps into DevSecOps including people, processes and tooling*
Plans, designs, implements, integrates and deploys security strategically into every step of the development lifecycle. Shared skills sets and collaboration help transform people, process and technology into DevSecOps best practices, backed up by the IBM® Application Security Center of Excellence.*
Empowers “shift-left” practices to reduce app security defects early in the SDLC. This helps reduce the cost of fixing software vulnerabilities and improve compliance with industry and government regulations.*
Enables security automation and integration into the continuous integration and continuous deployment pipeline. Application security training onsite or online can drive productivity between DevOps and security for rapid innovation and security-focused software development.*
There are a number of precautions you should take. For example, all unused services, command shells and programming language interpreters or compilers should be removed. Web servers should be configured correctly and file permissions should be granted on a need-to-know basis to authorised parties only. System and web logs should also be regularly checked for suspicious activity. In addition, the number of web user accounts that can login to web servers should be properly managed (e.g. ensure that all users select good passwords). User authentication on the web server should be protected by at least SSL/TLS to ensure that passwords cannot be eavesdropped by attackers. Two-factor authentication should also be considered if the system involves sensitive or confidential information.
The following can be observed for enhancing the security of web servers:
The following are most common vulnerabilities found in web applications:
The following are security tips for end-users:
Various security controls should be considered throughout the entire development lifecycle of the project:
The following are some examples of areas that might be examined in an assessment of web application security:
Identification and Authentication
Data Protection
Logging
Error Handling
Operation
There are three basic authentication factors (i.e. "something you know", "something you have", and "something you are") commonly referred to in an authentication system. As a way of tackling the increasing threat of identity theft, two-factor authentication for conducting high-risk e-transactions should be implemented. There are five common authentication methods; namely passwords and PINs based authentication, SMS based authentication, symmetric-key authentication, public-key authentication and biometric authentication. Details of each method is available at the e-Authentication website.
A suggested process flow for business owners wishing to implement a secure e-Authentication system is available at the e-Authentication website . You can find more information here on determining the assurance levels and corresponding security requirements.
