News

RSA: Hackers Shifting Focus to App Software

Writing more secure software is not a simple task, but it can and should be done for applications, experts say.

"The guys who write systems are pushing their people to write secure software," said Alan Paller, director of research for the SANS Institute. "But the application people have never done that."

As operating systems have become less easy to attack, those writing malicious code are turning more of their attention to applications. Paller said that 90 percent of new hacking tools target applications, a significant increase in the last year.

Paller is not alone in his concerns.

"I share the frustration of the rest of the IT and business worlds that more progress hasn't been made in having sound, secure software," said W. Hord Tipton, executive director of the International Information Systems Security Certification Consortium and a former Interior Department CIO. "We seem to be losing ground."

Not that there are not some areas for hope. "It's extremely spotty," Paller said. "But it's gaining extraordinary ground in the spots." As a nation overall, however, "we suck," he said.

Paller and Tipton are among a panel of experts discussing the challenges of software assurance at the RSA security conference. The security (or insecurity) of applications is a growing concern. A recent study of 200 businesses by Forrester commissioned by Veracode Inc. found that 62 percent had experienced a security breach in the last year because of vulnerabilities in critical software applications. Despite the size of the security hole this represents, only 13 percent of respondents said they knew the security quality of their critical applications, and only 34 percent had a comprehensive software development life cycle process integrating application security.

Tools are available to help with software assurance. IBM Corp. is announcing at RSA this week that its Rational AppScan product now will incorporate the ability to recognize malicious code in program as well as scan for vulnerabilities.

The company's Rational product line is a platform for software development and delivery, and allows code to be evaluated in the production environment as well as during the development phase. A fourfold increase in the amount of malicious code being found in legitimate Web sites in the last year has created a demand for the capability to discover malicious code, said Danny Allan, director of security research for IBM Rational. An estimated 80 percent of malicious code is being delivered through legitimate Web sites where it has been placed surreptitiously.

About the Author

William Jackson is the senior writer for Government Computer News (GCN.com).

Featured

  • Microsoft Offers Support Extensions for Exchange 2016 and 2019

    Microsoft has introduced a paid Extended Security Update (ESU) program for on-premises Exchange Server 2016 and 2019, offering a crucial safety cushion as both versions near their Oct. 14, 2025 end-of-support date.

  • An image of planes flying around a globe

    2025 Microsoft Conference Calendar: For Partners, IT Pros and Developers

    Here's your guide to all the IT training sessions, partner meet-ups and annual Microsoft conferences you won't want to miss.

  • Notebook

    Microsoft Centers AI, Security and Partner Dogfooding at MCAPS

    Microsoft's second annual MCAPS for Partners event took place Tuesday, delivering a volley of updates and directives for its partners for fiscal 2026.

  • Microsoft Layoffs: AI Is the Obvious Elephant in the Room

    As Microsoft doubles down on an $80 billion bet on AI this fiscal year, its workforce reductions are drawing scrutiny over whether AI's ascent is quietly reshaping its human capital strategy, even as official messaging avoids drawing a direct line.