Automated quality assurance-verification tools are often used to test software once it has been built, either by...
By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
performing automated code analysis or vulnerability testing. The latter approach simulates an attacker hacking away at the application, while the former plays the role of an intelligent examiner that reviews the code; product examples include offerings from Ounce Labs Inc., Fortify Software Inc., and SPI Dynamics. For basic testing, you can have your own coders review each other's work, or you can hire an outside coder to offer a fresh perspective on where the gaps may lie.
Despite advances in computer automation, humans are still superior at ensuring applications are developed securely, probably because the best challenge is posed by humans, notably those who can think as an attacker would. However, human work is often more effective if a framework guides it. There are numerous examples of secure software development life cycle processes. The U.S. Department of Homeland Security is a good starting point to learn more.
While some of these frameworks have been applied to massive projects, such as aircraft flight control systems, other development guides can be readily used for much smaller initiatives. Such is the case with Microsoft's Trustworthy Computing Security Development Lifecycle, which breaks the build process into six phases: requirements, design, implementation, verification, release and support/servicing. And while Microsoft is hardly synonymous with software security, the company's Security by Design initiative is a valuable contribution to the creation of more secure applications.
- If your application development process is not yet addressing security at all six phases, now is the time to start. In the meantime, be sure to read Ed Skoudis' article on software development best practices that can prevent input-validation attacks.
Dig Deeper on Software Development Methodology
Related Q&A from Michael Cobb
Amazon disabled native encryption capabilities in the latest Fire OS version. Expert Michael Cobb explains what this means for security, and if ...continue reading
A pirated app called Happy Daily English beat Apple's App Store security review. Expert Michael Cobb explains how it works and what security teams ...continue reading
The Lenovo SHAREit file-sharing app has a hardcoded password vulnerability, among other issues. Expert Michael Cobb explains these flaws and how to ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.