What approach should organizations take regarding application security?

In this significant interview with Wise TV, Murat Lostar, General Manager of Lostar, explains why security is often sidelined during application development processes and discusses how organizations should adopt a risk-based approach to security.

The number of applications worldwide is growing at an incredible pace. Whatever we might need or think of, we can find an app for it—and the developers behind these applications are locked in a fierce race. Driven by the desire to bring an idea to market as quickly as possible to maximize adoption, they often neglect security; as a result, applications frequently fall short of even the most basic security standards, let alone optimal ones. Attackers, well aware of this, increasingly target applications rather than traditional infrastructure, core systems, or networks. They know that it is often easier to uncover vulnerabilities in applications, providing a gateway to infiltrate the broader environment. However, applications should be classified based on how they are used, the data they store, and the functions they perform. Consider a mid-sized organization with a few hundred employees: an Enterprise Resource Planning (ERP) system—which holds all the company’s commercial data—carries a different level of risk than a Customer Relationship Management (CRM) system, which houses sales and e-marketing data, or a Human Resources application, which might only be used occasionally for new hires. Organizations must first categorize their applications according to their risk profiles—for instance, by labeling them as high-risk, medium-risk, or low-risk. Furthermore, depending on the nature of the changes made to these applications—whether it’s something as minor as a single semicolon, the addition of a module, or a complete rewrite—they should ensure that any high-risk or major modifications undergo additional security-related testing and analysis before the application is deployed. For lower-priority applications, however, they may choose to deploy the application first and conduct testing along the way, as the potential risks arising from such applications would be minimal.

Application Development and Security Challenges

In today’s rapidly evolving technological landscape, the application development process plays a pivotal role. New applications are launched daily, aiming to address the diverse needs of users. However, this rapid pace of development often introduces various security vulnerabilities. Application developers must balance the realization of innovative ideas with a rigorous focus on security.

Security Vulnerabilities and Attacker Preferences

Security vulnerabilities within applications have made them attractive targets for attackers. Infiltration attempts via applications have become more prevalent than those targeting traditional systems or networks, largely because security flaws can often be identified more quickly and easily within applications. This reality compels developers to exercise greater caution.

Risk Classification by Application Type

Applications carry varying levels of risk, depending on their intended purpose and the data they process. For instance, an enterprise resource planning (ERP) system, customer relationship management (CRM) software, and a human resources application do not pose the same level of risk. Consequently, organizations should classify their applications based on their risk profiles and implement security measures accordingly.

Change Management and Security Testing

Any modifications made to an application must be handled with careful consideration for security. Even a minor change can impact an application’s overall security posture. Therefore, for high-risk or significant changes, comprehensive security testing and analysis must be conducted before the application is deployed. For lower-priority applications, such testing may be performed after the application has been deployed. The Importance of Security Testing

Security testing plays a critical role in ensuring the security of applications. Such testing is essential for identifying and addressing potential security vulnerabilities. By conducting these tests regularly, application developers can enhance the security of their applications and protect user data.

Responsibilities of Application Developers

Application developers should not only focus on bringing innovative ideas to life but also prioritize user security. Doing so will both increase user satisfaction and contribute to the long-term success of an application. Security measures must be an integral part of the application development process.

Conclusion

The application development process holds a significant place in a rapidly evolving technological landscape. However, this rapid development also brings certain security vulnerabilities. While bringing their innovative ideas to fruition, application developers must simultaneously remain attentive to security concerns. Security flaws in applications make them attractive targets for attackers. Therefore, by performing regular security tests, developers can strengthen the security of their applications and safeguard user data—ultimately boosting user satisfaction and ensuring the long-term success of their applications.