Measuring and Managing Information Risk: A FAIR Approach by Jack Freund & Jack Jones

Author:Jack Freund & Jack Jones [Freund, Jack]
Language: eng
Format: azw3
ISBN: 9780127999326
Publisher: Elsevier Science
Published: 2014-08-22T16:00:00+00:00

Web application risk

Web application vulnerability is a special case of the previous section. There are some unique aspects about it, however, that warrant a short section unto itself.

Similar to vulnerability scanner results in general, we very often see results from web application scanners that don’t stand up to even superficial review. Consequently, organizations are faced with the same choices we mentioned before—aggressive remediation regardless of the cost, setting long remediation timelines, or a lot of missed remediation deadlines. Aggressive remediation of web application vulnerabilities—especially for applications written in-house by the organization—potentially has a more direct effect on the organization’s ability to grow and evolve as a business. Specifically, very often the programmers who are tasked with fixing vulnerable conditions are the same ones who should be developing new business-enabling web application capabilities and features. As a result, the time spent fixing bugs equates to lost business opportunity. This can create a pretty strong tension between the security team and the development team, as the security team is focused on protecting the organization and the development team is focused on growing the business. It also makes it especially important to only fix bugs that really need to be fixed. Ideally, organizations avoid this problem by writing secure code to begin with, but this is sometimes easier said than done given the complexity of some applications, the inevitable variability in developer skills, and the evolution of threat capabilities.

Some important considerations that can help you triage the findings (we’ll call the findings “deficiencies”) that come out of many web application vulnerability scanners include:

• Is the web application Internet-facing? If it isn’t, then the TEF should be considerably lower, unless an organization has a pretty unusual internal threat landscape.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.