Building Knowledge about Application Security

Computerworld —

The weakest link in my security experience is application security. It never mattered a lot, because I always had someone working for me who had the experience I lacked. That all changed when I came to this state agency, though. For the first time, I have no one who can make up for my shortfall in this area.

We outsource our major information systems. However, we are going to start developing some internal applications. That makes me nervous. Our outsourcing vendor is contractually obligated to protect confidential information, something that is vitally important for the agency. When we start doing our own programming, how will I be able to ensure that secure coding methods are being followed? It's time once again to educate myself.

Back when I was in the private sector and working in information security in the financial industry, we approached application security by sitting in on the meetings of the application development team. We might not have understood everything that was said about the actual coding, but we were able to advise the team on things like server and network architecture. For example, if a Web application was being developed, we would make sure that the Web server, application server and database server were located in distinct security zones.

But in the private sector, we always had a lot of people to work on problems, and each person could become specialized. Here, I wear a lot of hats. One of my responsibilities is preparing us for internal audits. So, what's the auditor's view of application security? According to guidelines published by the Information Systems Audit and Control Association, "The purpose of an application systems review is to identify, document, test and evaluate the controls over an application that are implemented by an organization to achieve relevant control objectives. These control objectives can be categorized in control objectives over the system and the related data."

That's a start. And anyone familiar with Cobit (Control Objectives for Information and Related Technology) knows that the primary criteria for auditing applications are effectiveness, efficiency, confidentiality, integrity, availability, compliance and reliability of information.

The first two on that list, effectiveness and efficiency, aren't big concerns right now. I need to focus on confidentiality, integrity and compliance. We'll be handling confidential health information with our new applications. Compliance with the Health Insurance Portability and Accountability Act is serious business, and there's a lot of potential for inadvertent exposure of protected information if we put these applications on the Web.

Continue Reading