1. Sujata December 22, 2017
Securing Bits To Protect Humanity
www.taslet.com/application-security-best-practices-framework/
The Year 2017 was the year of globally impacting attacks likeWannaCry and Petya and
high profile data breaches like Equifax , Uber , Yahoo where millions of user accounts were
stolen by the attackers.
Equifax, one of the three largest credit agencies in the U.S., suffered a breach that may
affect 143 million consumers. Hackers were able to access personal data of 143 million
Equifax customers—including Social Security numbers and driver’s license numbers. This
is one of the worst breaches ever. With help from Mandiant a professional cybersecurity
firm, Equifax was able to determine a series of breaches had occurred from May 13 through
July 30 hackers were able to exploit a weak point in website software.
As per the CNN tech news, the tool is called Apache Struts, and it’s used by many large
businesses and government organizations. Equifax used it to support its online dispute
portal — where Equifax (EFX) customers go to log issues with their credit reports. The flaw
allowed hackers to take control of a website.
This steers the entire conversation of end to end application security. In this article, we will
explore, what is the end to end application security and what needs to be done to stay
protected.
“Making web applications safe is in the best interest of all organizations and the general
economy. Providing a clearly defined set of web application security best practices will
advance security professionals’ ability to anticipate and rapidly address potential threats to
their enterprise.” -Yuval Ben-Itzhak, CTO and Co-Founder KaVaDo
What is Secure Application – What Needs to Be Protected?
As per Microsoft, the secure application is “A hack-resilient application, one that reduces
the likelihood of a successful attack and mitigates the extent of damage if an attack occurs.
A hack-resilient application resides on a secure host (server) in a secure network and is
developed using secure design and development guidelines.”
In simple word, Application security is dependent on many factors, that includes Secure
Software Development Life Cycle (SDLC), Secure hosting environment – servers / VMs,
Operating systems, databases, network connectivity, access controls, and process controls
like patching, backup, etc.
For any digital organization protecting data is important not only form the competitive
advantage point of view but also form the regulatory compliance requirements point of
view, e.g. GDPR. Applications are means of generating, collecting, processing and storing
data. To protect the data it is important to secure the application.
1/3

2. End to End Application Security
The Application security starts from the application design phase and goes on till the
application is decommissioned and data is destroyed in a secure way. Following diagram
provides the six phases that are part of the end to end application security.
1. Threat Modeling and Secure Software Development Life Cycle (S-SDLC) – The
Application security should be part of the design phase. During the design phase, it is
important to perform threat modeling considering factors like business requirements,
applicable regulatory compliances, data privacy applicability, hosting ( in-house DC,
cloud – Public /Private), access requirements (connectivity, type of access, devices)
and operations connectivity requirements. Depending on the information data of
captured requirements and threats identified, security controls need to be
incorporated in application architecture. Microsoft has provided very good
information about the Secure SDLC, this site provides the step by step information on
what needs to be done to make sure that sure that security is part of the entire
lifecycle.
2. Physical Security of Hosting facility – It is equally important to make sure that
facility in which the application is hosted has proper security controls like facility,
access control, all the entry and exit points are monitored using the CCTV camera,
and inside the data center there are controls to monitor HVAC (Humidity, Voltage,
and Air Conditioning). Physical access to racks networking bay is again monitored by
CCTV cameras and motion detectors etc. Here you will find more inputs on Data
Center Physical security. Also, refer this check list for validating the physical security
2/3

3. requirements.
3. Logical Security – Security the IT infrastructure – The operating systems,
databases, security and network infrastructure should be hardened to make sure only
required ports and services are allowed. The VPNs are configured to separate
internet, intranet, Production development and testing environment. When dealing
with compliances like PCI-DSS extra care should be taken to create separate zone
for payment card processing applications and all related infrastructure.
4. Compliance to Policies (Regulatory requirements & organization specific) –
While designing the application as well as implementing and configuring the IT
infrastructure , network and security controls make sure that organizations security
policies are implemented e.g. Access Control policies – who will have what level of
access . Processes are defined to execute these polices, e.g. Patch management
policy or change control policy.
5. Secure Operations – The threats are very dynamic and hence conducting the
vulnerability assessment and penetration testing is important to identify weakness in
the application and hosting infrastructure. Once the vulnerabilities are identified
assign the mitigation priority as per the risk scope relevant to your environment.
Collecting and analyzing the logs generated in your environment to identify
anomalies is another important activity to detect the attacks is early stage. Also
monitoring performance, resource utilization and availability of services will help to
make sure that application is available for the end users.
6. Secure Retiring process – Retiring or decommissioning application should not be
evaluated for the ROI perspective but also should be evaluated from the requirement
of the data from the regulatory compliance point of view. Before retiring application
make sure that the data can be migrated to the new application in a forensically
accepted ways. The old data and application then should be decommissioned in a
way that data cannot be retrieved from the hard disk and storage media. Read here
more about application retirement best practices.
The above six steps will help to improve the security posture of your application , you still
need to be watchful to identify the early signs of attacks and take action to reduce the
impact of security incident.
Conclusion
In this digital transformation era, businesses and government agencies are heavily
dependent on the applications to achieve the goals. The applications generate, process
and stores the data which may be business critical contains personal identifiable and
confidential information which regulators are mandating to protect, hackers attackers can
exploit the application vulnerabilities to get hold of the data. Hence application security
becomes at most important and cannot be looked into the isolation. The application
security starts from the design phase and ends when the application is decommissioned
and data is destroyed in secure way.
3/3