How Secure is Secure Enough? Software Cyber Security

There’s no denying that cloud computing packs tons of benefits for software developers. From scalability to improved collaboration and easy deployment, it’s easy to understand why the cloud is such a crucial environment for developers.

However, software development teams can’t deny the security threat that comes with this movement. Sure enough, cloud providers and developers have stringent measures to ensure a safe plan. But what’s not clear for most companies that produce software is determining when their products are safe enough.

Security in software development is an ever-moving target. As secure cloud-based software technologies become sophisticated, so do cloud security threats. But with a budget to utilize across all phases of successful software development, the responsibility is on the developers to ensure that security is perfectly adequate, not unnecessarily too much or dangerously little.

Determining Adequate Security in Software Development

When it comes to application security, it’s nearly impossible to have 100% secure systems for some reason.

First, codes and software architecture and design are developed by people. Thus, no matter how keen an individual or an entire security team is, it’s hard to conceive all potentially dangerous vulnerabilities hackers can exploit.

Steve McConnell, the author of Code Complete, estimates the average industry ratio of errors to 15-50 per 1000 lines of code delivered.

The other reason why 100% secure software is almost unachievable is the need to balance usability and security. Security teams can only impose so many security controls before rendering the software practically unusable and unused.

That being said, adequate software security comes down to these three things:

1. How much security do you need?
2. What’s your organization’s/enterprises’ risk tolerance?
3. Your cybersecurity budget

How Much Security?

A crucial step when determining adequate security is determining which software components must be part of the secure development lifecycle. Ideally, software developers should ensure that the most critical parts of the software are not left exposed.

Keep in mind that no vulnerability is too tiny for malicious actors to ignore. The idea is to start with the most vulnerable components and then move on to other software parts.

Figuring out what parts of the software to secure first requires a clear understanding of the level of threat posed and the likelihood of an attack from that part.

Establishing Your Business’ Risk Tolerance

Application developers face a barrage of threats that could disrupt operations. But instead of trying to resolve all risks, cybersecurity professionals should start by defining the business’ risk tolerance.

Risk tolerance in application development refers to the level of attack that the business can take without breaking. Risk tolerance is the residual risk an organization can withstand after mitigation for known and evaluated software threats.

Without a risk tolerance assessment, it’s hard for the experts to determine how to secure the business effectively.

The best way to define risk tolerance is by application security assessment. Generally, this is a way of identifying possible risks and classifying them based on how much damage they are likely to cause if they occur. To do this, the stakeholders need to classify impacts of varying risks as high, medium or low.

Results from the threat assessment should provide in-depth information on what threats to channel the available resources to depending on the severity. Such findings might even indicate when the cost of resolving some risks isn’t justified.

Here are helpful questions to help you classify risks;

• What are the regulatory or industry compliance obligations towards that particular threat?
• How much damage in monetary value is a risk likely to cause if it were to happen?
• How much would the business be willing to spend to remediate a threat with the ability to cause, let’s say, $2000 or $1 million in damages?
• What’s the acceptable downtime due to a disrupted system?

Security Budget

How much you allocate for cybersecurity is another crucial indicator of whether your software is secure enough. The amount of money spent on cybersecurity by businesses is set to grow in the upcoming years.

Of course, it’s not enough to have an unlimited AppSec budget if the desired level of security can be achieved without overspending. But with cases of cyberattacks and data breaches being published daily, software security budget is not something to take lightly.

There are lots of factors in play when it comes to determining a budget for application security. Again, no two businesses are the same. What’s enough for one business may be more than enough or too little for another.

Generally, many cybersecurity professionals suggest spending around 10% of the IT budget for security purposes. But most companies spend 15-20%.

Security Metrics for Measuring Software Security

Instead of worrying whether they have enough application security, businesses should come up with metrics to measure risk vs. progress. Results from these metrics could inform possible remedies and the type of training needed to prevent such vulnerabilities in the future.

Here are practical and straightforward application security metrics that businesses may consider:

1. Number of apps already covered by the existing security system

When creating a security system, it’s recommended to start with high-risk applications first and then incorporate other apps. Importantly, consider both new and legacy applications when determining where to start.

2. How fast can the IT team remediate a flaw?

Because security is a moving target, application development teams should mainly focus on how quickly they can resolve the vulnerabilities. For success, you want an agile team that’s always ahead of cyberattackers. To achieve this, the team should be able to fix bugs as they pop up.

3. How fast are vulnerabilities created?

Closely related to the speed of remediating loopholes is how fast the development team creates risk during the development cycle. Security teams should strive to solve vulnerabilities faster than new ones are being created.

Conclusion

Application security is a demanding (sometimes expensive) but essential part of the development cycle. The tips above should provide an insight into whether you’re headed in the right direction.

Note that a comprehensive application security system starts with integrating and running AppSec tools throughout the development cycle. That way, it’s fast and relatively cheap to fix flaws as they arise.