Veracode, Inc., the leader in cloud-based application security testing, encourages application developers to take a more proactive role in securing applications as part of a larger call to action to protect companies from vulnerabilities. Each year, companies spend billions of dollars on outsourcing software development, yet very little is spent on security verification, resulting in security breaches caused by software vulnerabilities.
“We developed these eLearning courses to provide developers with the guidelines and best practices that they should take to ensure the security of their customers.”
Veracode also aims to limit the amount of security checks companies have to make when purchasing third-party applications by offering to developers a web-based eLearning training program. The online courses provide developers with certification and CPE credits and teach developers secure coding for ASP.NET, J2EE and C/C++. eLearning also aims to help developers measure and track their development progress and comply with ISO regulations and industry standards such as SANS Application Security Procurement Contract Language.
“The simple fact is that if someone wants your intellectual property, they are going to use the software you bought, built or outsourced to get it,” said Chris Eng, vice president of research, Veracode. “We developed these eLearning courses to provide developers with the guidelines and best practices that they should take to ensure the security of their customers.”
Veracode suggests that by following its eLearning development suggestions, developers will be able to:
1. Protect companies from vulnerabilities. With the vast amount of threats that constantly pressure companies and government, it is important to ensure that the software applications these organizations utilize are completely secure. To certify applications are free of vulnerabilities, several processes must be employed within the Secure Development Lifecycle (SDLC), including testing the application’s security controls at each stage of development. Such tests include static analysis, dynamic analysis or penetration testing.
2. Preserve data, IP and brand reputation. Some of the most critical application security flaws, including Cross Site Scripting (XSS) and broken authentication, allow for easy exploitation where attackers can completely take over the software, steal data, or prevent the software from working at all. In order to prevent these flaws, security practices must be integrated within the SDLC, and security of internally developed applications must be verified before they are deployed. Additionally, staying on top of patches and software updates can help bring attention to previously undiscovered flaws.
3. Perform business as usual. During the SDLC, developers must model an application, scan the code, check the quality and ensure that it meets regulations, on top of building a unique and useful application. Automated secure development testing tools help developers adhere to these development steps, while finding and fixing security issues at the same time. Veracode offers these services as well as secure development training so that developers can gain further education and insight into security issues they may have created.
Veracode wants all developers to keep these guidelines in mind when creating applications, as they allow them to detect flaws, test the security features of the applications, and ensure the customer’s data is protected above all else.
Source: BusinessWire
No comments:
Post a Comment