CSO — With breaches ever on the rise and software vulnerabilities at the heart of many security incidents, CSOonline decided to talk with noted software security expert Rafal Los. Los, currently security evangelist with Hewlett-Packard Software, is an industry veteran who has worked as a security consultant and even as information security officer in the Fortune 100. We wanted to get his thoughts on what organizations can do -- today -- to improve the security of the applications they develop.

Also see: Secure coding: A survival guide

CSOonline: There have been numerous articles, books and presentations on how to get a web application security program started. But there are very few on how to manage it properly once it's in place. So once you've made the commitment, and have started down a secure software development path, how do you keep it on track?

Rafal Los: Once you've decided that you're going to have a secure application development program, you've got to make sure that you're measuring the right things. That is critical. I don't think enough organizations do this. I think they just dive in and think: "Whatever we want to do is going to be great. People are going to nod in agreement, and there will be great fanfare and cheering and lots of excitement about application security." That's just unfortunately not the case. And organizations have to understand that measuring the wrong things can be just as bad as not measuring anything.

You mean measuring the wrong outcomes could hurt your efforts?

You could actually make things worse. With security, it can very quickly turn into a never-ending money vacuum. And what CIO's fear very much is that's exactly what it turns into: a never-ending money vacuum. It's not supposed to be: "OK. Just keep spending money. There's always risks to lower." Well, of course there are always risks. But you have to make sure you are spending money wisely.

Get your morning news fix with the daily Salted Hash e-newsletter! Sign up today.

You have to be reasonable, right? If you get in the car, you put on your seatbelt. Now, there's always risks that you could get in an accident where the impact is so great that the seatbelt doesn't really matter. But probability-wise, it's the smart thing to do. You're reducing your risk of serious injury substantially.

Sure. And there's always those people who will tell you that. I was in a car wreck where the seatbelt literally did harm. But if you think about it the other way, it also kept them alive. So, it depends on what you're measuring. If you're looking at it from, 'Did it do me harm?' Well yes, it did. 'Did it also keep me from dying?' Yes it did. I think a lot of companies have lost that necessary perspective. I talk to a lot of companies that say, "We're going to go scan everything." And I ask: "Does that even make sense? Do you even want to do that? Do you have enough money to do that? Does that really make sense to you?"

Continue Reading