News

RSA: Hackers Shifting Focus to App Software

Writing more secure software is not a simple task, but it can and should be done for applications, experts say.

"The guys who write systems are pushing their people to write secure software," said Alan Paller, director of research for the SANS Institute. "But the application people have never done that."

As operating systems have become less easy to attack, those writing malicious code are turning more of their attention to applications. Paller said that 90 percent of new hacking tools target applications, a significant increase in the last year.

Paller is not alone in his concerns.

"I share the frustration of the rest of the IT and business worlds that more progress hasn't been made in having sound, secure software," said W. Hord Tipton, executive director of the International Information Systems Security Certification Consortium and a former Interior Department CIO. "We seem to be losing ground."

Not that there are not some areas for hope. "It's extremely spotty," Paller said. "But it's gaining extraordinary ground in the spots." As a nation overall, however, "we suck," he said.

Paller and Tipton are among a panel of experts discussing the challenges of software assurance at the RSA security conference. The security (or insecurity) of applications is a growing concern. A recent study of 200 businesses by Forrester commissioned by Veracode Inc. found that 62 percent had experienced a security breach in the last year because of vulnerabilities in critical software applications. Despite the size of the security hole this represents, only 13 percent of respondents said they knew the security quality of their critical applications, and only 34 percent had a comprehensive software development life cycle process integrating application security.

Tools are available to help with software assurance. IBM Corp. is announcing at RSA this week that its Rational AppScan product now will incorporate the ability to recognize malicious code in program as well as scan for vulnerabilities.

The company's Rational product line is a platform for software development and delivery, and allows code to be evaluated in the production environment as well as during the development phase. A fourfold increase in the amount of malicious code being found in legitimate Web sites in the last year has created a demand for the capability to discover malicious code, said Danny Allan, director of security research for IBM Rational. An estimated 80 percent of malicious code is being delivered through legitimate Web sites where it has been placed surreptitiously.

About the Author

William Jackson is the senior writer for Government Computer News (GCN.com).

Featured

  • Microsoft Talks Teams and SharePoint at Modern Workplace Event

    It's a hybrid world, but remote work is here to stay, according to Microsoft's Teams and SharePoint head Jeff Teper.

  • Malwarebytes Affirms Other APT Attack Methods Used Besides 'Solorigate'

    Security solutions company Malwarebytes affirmed on Monday that alternative methods besides tainted SolarWinds Orion software were used in the recent "Solorigate" advanced persistent threat (APT) attacks.

  • How To Fix the Hyper-V Read Only Disk Problem

    DOS might seem like a relic now, but sometimes it's the only way to fix a problem that Windows seems ill-equipped to deal with -- like this one.

  • Microsoft Warns IT Pros on Windows Netlogon Fix Coming Next Month

    Microsoft on Thursday issued a reminder to organizations to ensure that their systems are properly patched for a "Critical"-rated Windows Netlogon vulnerability before next month's "update Tuesday" patch distribution arrives.

comments powered by Disqus