- Forrester Councils
- Councils Overview
- log in
Posted by Andrew Rose on February 10, 2012
Security threats develop and evolve with startling rapidity, with the attackers always seeking to stay one step ahead of the S&R professional. The agility of our aggressors is understandable; they do not have the same service-focused restrictions that most organizations have, and they seek to find and exploit individual weaknesses in the vast sea of interconnecting technology that is our computing infrastructure.
If we are to stand a chance of breaking even in this game, we have to learn our lessons and ensure that we don’t repeat the same mistakes over and over. Unfortunately, it is alarmingly common to see well known vulnerabilities and weakness being baked right in to new applications and systems – just as if the past 5 years had never happened!
A recent report released by Alex Hopkins of Context Information Security shines a light on the vulnerabilities they discovered while testing almost 600 pre-release web applications during 2011. The headlines for me were:
It makes depressing reading, but I’m interested in why this situation is occurring:
In my experience, most developers are keen to learn how to write secure code and there are simple and effective solutions that can really help, such as coding standards, peer review, testing standards, reusable subroutines, etc. This data, however, suggests that a fair amount of organizations are sadly overlooking these.
Training and awareness is a topic I’ll be delving into later in the year, but I’d be interested in why you think app devs don’t seem to have turned the corner and what techniques you have found to be effective in improving the quality of your firm’s coding.
Lead BT Transformation
Develop customer-obsessed strategies to drive growth »
Forrester's CX Index
Predict how actions to improve CX will affect revenue performance.
Measure the customer experiences that matter most »