News

RSA: Hackers Shifting Focus to App Software

Writing more secure software is not a simple task, but it can and should be done for applications, experts say.

"The guys who write systems are pushing their people to write secure software," said Alan Paller, director of research for the SANS Institute. "But the application people have never done that."

As operating systems have become less easy to attack, those writing malicious code are turning more of their attention to applications. Paller said that 90 percent of new hacking tools target applications, a significant increase in the last year.

Paller is not alone in his concerns.

"I share the frustration of the rest of the IT and business worlds that more progress hasn't been made in having sound, secure software," said W. Hord Tipton, executive director of the International Information Systems Security Certification Consortium and a former Interior Department CIO. "We seem to be losing ground."

Not that there are not some areas for hope. "It's extremely spotty," Paller said. "But it's gaining extraordinary ground in the spots." As a nation overall, however, "we suck," he said.

Paller and Tipton are among a panel of experts discussing the challenges of software assurance at the RSA security conference. The security (or insecurity) of applications is a growing concern. A recent study of 200 businesses by Forrester commissioned by Veracode Inc. found that 62 percent had experienced a security breach in the last year because of vulnerabilities in critical software applications. Despite the size of the security hole this represents, only 13 percent of respondents said they knew the security quality of their critical applications, and only 34 percent had a comprehensive software development life cycle process integrating application security.

Tools are available to help with software assurance. IBM Corp. is announcing at RSA this week that its Rational AppScan product now will incorporate the ability to recognize malicious code in program as well as scan for vulnerabilities.

The company's Rational product line is a platform for software development and delivery, and allows code to be evaluated in the production environment as well as during the development phase. A fourfold increase in the amount of malicious code being found in legitimate Web sites in the last year has created a demand for the capability to discover malicious code, said Danny Allan, director of security research for IBM Rational. An estimated 80 percent of malicious code is being delivered through legitimate Web sites where it has been placed surreptitiously.

About the Author

William Jackson is the senior writer for Government Computer News (GCN.com).

Featured

  • Microsoft Appoints Althoff as New CEO for Commercial Business

    Microsoft CEO and chairman Satya Nadella on Wednesday announced the promotion of Judson Althoff to CEO of the company's commercial business, presenting the move as a response to the dramatic industrywide shifts caused by AI.

  • Broadcom Revamps VMware Partner Program Again

    Broadcom recently announced a significant update regarding its VMware Cloud Service Provider (VCSP) program, coinciding with the release of VMware Cloud Foundation (VCF) 9.0, a key component in Broadcom’s private cloud strategy.

  • Closeup of the new Copilot keyboard key

    Microsoft Updates Copilot To Add Context-Sensitive Agents to Teams, SharePoint

    Microsoft has rolled out a new public preview for collaborative "always on" agents in Microsoft 365 Copilot, bringing enhanced, context-aware tools into Teams channels, meetings, SharePoint sites, Planner workstreams and Viva Engage communities.

  • Windows 365 Cloud Apps Now Available for Public Preview

    Microsoft announced this week that Windows 365 Cloud Apps are now available for public preview. This aims to allow IT administrators to stream individual Windows applications from the cloud, removing the need to assign Cloud PCs to every user.