Cyber Security is one of the major challenges facing organizations within all industries. This requires an Enterprise Security Architecture approach, frameworks TOGAF and SABSA which provides an important generic approach to Information Security. The objectives of integrating these approaches include; the creation of an overall architectural view of the organization, the mitigation of security risks and maintenance of a secure business environment. Security Architecture is a unified security design that addresses the necessities and potential risks involved in a certain scenario or environment. It also specifies when and where to apply security controls.
Application Security with the analogy of a crown jewel in a treasure chest; the sensitive information is the crown jewel, and the applications are the treasure chest. To get at the jewels, attackers need to attack vulnerabilities in the application.
Application security, or “AppSec,” is what an organization does to protect its critical data from external threats by ensuring the security of all of the software used to run the business, whether built internally, bought or downloaded. Application security helps identify, fix and prevent security vulnerabilities in any kind of software application. Actions taken to ensure application security are sometimes called countermeasures. The most basic software countermeasure is an application firewall that limits the execution of files or the handling of data by specific installed programs. The most common hardware countermeasure is a router that can prevent the IP address of an individual computer from being directly visible on the Internet. Other countermeasures include conventional firewalls, encryption/ decryption programs, anti-virus programs, spyware detection/removal programs and biometric authentication systems.
Application security can be enhanced by rigorously defining enterprise assets, identifying what each application does (or will do) with respect to these assets, creating a security profile for each application, identifying and prioritizing potential threats and documenting adverse events and the actions taken in each case. This process is known as threat modeling. In this context, a threat is any potential or actual adverse event that can compromise the assets of an enterprise, including both malicious events, such as a denial-of-service (DoS) attack, and unplanned events, such as the failure of a storage device.
Assesses every application, whether built in-house, purchased or compiled
- Enables developers to find and fix vulnerabilities while they are coding
- Takes advantage of automation and cloud-based services to more easily
- Incorporate security into the development process and scale the program
Static Analysis (SAST), or “white-box” testing, analyzes applications without executing them.
Dynamic Analysis (DAST), or “black-box” testing, identifies vulnerabilities in running web applications.
Software Composition Analysis (SCA) analyzes open source and third-party components.
Manual Penetration Testing (or “pen testing”) uses the same methodology cybercriminals use to exploit application weaknesses.