Building App Layer Security Into the Supply Chain

 

Hailey Lynne McKeefry
2/24/2014   

Today's complex and complicated supply chain translates into
quick communication with partners. At the same time, it creates huge opportunity for data leakage and security issues that need to be addressed proactively in supply chain
systems.

"Every enterprise is connected in some way to its partners in the supply chain and must allow access to communicate back and forth," Bala Venkat, chief marketing officer at the applications security vendor Cenzic, told us. "That exposes third-party applications. Unfortunately, we see a high level of confusion about what application security is. Too often, it gets confused with network layer or secure socket layer security. "

Partners in the supply chain may serve as a back door to a desired target. "Hackers often try to find the weakest link of the network they want to attack," Venkat said. "Connection-related attacks are becoming increasingly popular, so it's become very compelling to solve."

Today, the electronics supply chain faces a daunting number of potential security flaws, including form caching issues, JavaScript vulnerabilities, SQL injection attacks, and web server configuration vulnerabilities. Each makes critical information, from product designs to price lists, vulnerable to attack. The rise of mobile supply chain apps will only increase the potential application vulnerabilities of the supply chain.

The answer, then, is a proactive look at the security of supply chain software being used by the organization and its partners. "You simply can't tell a partner that you can't connect with their systems, but you can ask for independent verification that the applications in question are free from all the possible vulnerabilities that exist."

Today, Cenzic introduced its Partner Application Security Certification Testing Program, which offers this type of certification. The Cenzic Partner-Application Security Scanning(Cenzic PASS) service uses a combination of consulting and cloud-based vulnerability scanning-as-a-service to test and certify integrated applications. Venkat said it can identify and help remediate more than 6,000 vulnerabilities.
Knowing how to launch a process around application security can be daunting. However, Venkat recommends a three-step assessment process.

1. Define the security standards: Understand what applications are being used to connect partners across the supply chain. What standards do they meet? What level of vulnerability scanning is needed? Financial, logistics, and accounting applications, for example, are likely targets and should be rigorously protected. "As part of step one, there needs to be an automated workflow, so application owners are guided through the process of managing associated applications."
2. Ask partners to take responsibility for scanning their apps: After classifying applications as high, medium, or low risk, partners should scan each one for security holes and remediate them.
3. Appoint an administrator to monitor and manage app certification: Since software is constantly upgraded and updated, someone has to monitor and verify that all critical applications are being secured. "This person would monitor the dashboard report on what applications are certified and which have not."

Too often, application security becomes a reactive activity; it takes center stage only after a breach has occurred.

Measuring the effectiveness of your security awareness program

Organizations that maximize the efficacy of their security awareness programs stand to benefit not only from better incident prevention, but many other benefits as well, including improved reputation and customer loyalty, says John Schroeter

                                                     

By John Schroeter

                   

February 12, 2014 — CSO — As Yogi Berra put it, "If you don't know where you're going, you'll end up someplace else." Do you know where you're going with respect to your privacy and security awareness programs? How will you know when–or if–you get there?

How to use Syrian Electronic Army attacks to improve security awareness

"But wait just a minute," you object. "Everyone knows that security is a process, not a destination. Is there really any such thing as arriving?" Well, of course there is. Just because a process is dynamic doesn't mean it's left without any measurable aspects. Besides, if any process is to be improved, it must also be measured.

There are many benefits an organization will enjoy when it makes those improvements, not the least of which is the budget justification for creating a security awareness program that help will boost security effectiveness overall. Martin Sadler, Director of Security at HP Labs, summed them up thusly: "

Organizations that have achieved a high level of security effectiveness are better able to identify major data breaches, secure confidential information, limit physical access to data storage devices, and achieve compliance with legal and self-regulatory frameworks. They are also in a better position to attract and retain high-quality security personnel and enforce corporate policies."

Those benefits have ripple effects throughout the organization—benefits that span protecting the company reputation to increasing customer trust and loyalty. And those translate directly to the bottom line.

Granted, measuring security effectiveness is not as straightforward as measuring a manufacturing process. There are many variables that are simply outside of one's direct control. In fact, a recent ISACA report conceded, "...security is contextual and not an isolated discipline; it depends on the organization and its operations.

Furthermore, effective security must take into account the dynamically changing risk environment within which most organizations are expected to survive and thrive." All the more reason that improvements be addressed wherever possible!

In any case, this variability may explain the disparity of results Dr. Kenneth Knapp discovered when he investigated the effectiveness of security programs. He found that while the majority of infosec professionals surveyed believed they were able to secure their information effectively, only 22 percent of them believed so with a high degree of confidence.

Punish careless employees to reduce security breaches, vendor says

Moreover, the survey showed that more than a third did not believe that their organization effectively secures its data. And this is likely understated. Sounds like room for improvement.