Posted on

What Is It Like to Be an Ethical Hacker?

There is a world war going on that people hardly talk about. While there aren't any physical explosions or military engagements, the threat is genuine and here to stay. This makes it important to take a page out of Sun Tzu's Art of War and think like the enemy or, in this case, black hat hackers.

In the current threat landscape, hacking grids, water plants, and leading businesses have become the norm. Furthermore, research suggests that cybercrime will cost the global economy a whopping $10.5 trillion annually by 2025.

Posted on

The Future of AppSec

To understand the current and future state of application security, we obtained insights from five IT executives. We asked them, “What’s the future for application security from your point of view?” Here’s what they told us: 

  • In the IT ecosystem, we have software-defined networks, software-defined infrastructure, software-defined virtual machines, and even software-defined radios. The future is in software-defined security —letting applications secure themselves through an integrated and automated software-security layer.
  • CISO’s fear of the data breach.  The biggest opportunity for improvement is with API breaches, where multimillion records are breached because compromised access to your backend. How do we get better?1) embrace automation and 2) shift in your architectural thought process and realize that we can’t depend on firewalls or agents on operating systems or a serverless app. It’s much better with identity management (2FA, MFA). Analyzer engines will be analyzing apps all the time. When vulnerabilities are found, they are codified into an actionable unit of work.
  • There is no silver bullet for application security in my opinion. The greatest opportunities lie in not looking for a single solution but focusing on visibility into what you’re doing and spreading your efforts to find vulnerabilities from various perspectives.
  • As connected devices continue to expand their footprint, we see opportunities to apply best practices in security to the Internet of Things.
  • It’s not an issue of technology; there’s plenty of great technology, and it’s not being used. We can do 8,000 enterprises if enterprises reach out to us. Business is doing what adds to their bottom line. Only visionary business leaders make security as important as quality. Loss of reputation, penalties for not protecting data will increase. Vendors have the capability to meet the needs of the enterprise, but the enterprise must want to secure their apps.

Here’s who shared their insights:

Posted on

Issues with AppSec

To understand the current and future state of application security, we obtained insights from five IT executives. We asked them, “What are the most common issues you see with application security?” Here’s what they told us: 

  • Two issues are the human attention span and the accuracy of automated systems. People who monitor or engage with security need to focus time and effort on things that matter and produce outcomes that serve a purpose. They cannot do that without accuracy, and accuracy comes from application-insight. The other is automation systems, where simply sending data is not helpful. Data must be relevant, with enough metadata to properly act. This relevance is tied to the application's insight.
  • There are so many guidelines right now. Authenticity, authorization, encryption, and availability mechanism – ensure all four are done with discipline and automation. Do the fundamentals well on APIs and mobile and modern web to avoid the majority of data breaches. When security hooks up with DevOps, it’s an impedance mismatch that causes a lot of friction.
  • The most common issue I see is doing nothing to secure your applications, followed closely by taking too narrow an approach to application security (for example, looking at security from only one perspective, such as static code analysis) and falling prey to a false sense of security. I don’t have the data to identify which is the largest actual risk based on break-ins, but I wouldn’t be surprised if the latter point is more critical.
  • We commonly see applications that are designed with security principles in mind but not from a network perspective. How an application acts on a single node in a network is different from how it behaves as it traverses the LAN and WAN. Our solution helps customers keep applications secure as they traverse networks, both local and wide-area.
  • Don’t use tools. AppSec testing technology today can come as a tool or a cloud service. Technology emerges first as a tool you learn to use, run, and be responsible for its accuracy and breadth. The next wave is when the technology is delivered as a cloud service. Now, we have more services than tools. Adopt technologies like cloud services rather than tools. Delegate AppSec to third-party vendors operating at high scale in the cloud.

Here’s who shared their insights: