How can software quality help enhance information security?

We all know that as the Internet of Things (IoT) and digital transformation make life more convenient and productive, these technologies also attract widespread cyber threats — not just for large enterprises, but also for small businesses and even individuals. Discover how software quality can help enhance information security.

From stealing bank accounts or consumers’ financial data to hacking public services or even nuclear plants, threats are everywhere. As a result, security has become a major concern for most companies, and CTOs, CIOs, and software engineers must stay alert to developing quality programs — which necessarily involves information security.

In fact, the high security demands of industrial IoT systems represent the number one challenge for developers. “In today’s technology environment, application security testing for vulnerabilities and flaws in software code should be a recommended best practice — regardless of the organization’s size or industry,” said Chris Wysopal, co-founder and CTO of Veracode, a software security company.

In a recent Veracode survey of IT decision-makers involved in cybersecurity, 83% of respondents admitted they released code before testing or resolving security issues involving bugs. And a report by IBM titled “The State of Mobile Application Insecurity” found that one-third of companies weren’t even testing their mobile apps for security vulnerabilities.

It’s alarming that, even though attacks on corporate assets are increasing every year, secure application and software development still lags behind — and is often widely neglected.

What stops someone from hacking into an online system or software application to steal data or gain access to critical processes? Both the threats and the solutions depend on software — and many software professionals are well aware of this.

One of the best lines of defense is secure development focused on quality assurance, testing, and code review. In fact, software developers — whether part of an in-house or outsourced team — can be your company’s frontline defense, as long as they maintain a security-first mindset.

How to verify the software development process?

There are several ways developers can test and verify code. For example, they can use static application security testing (SAST) tools or dynamic application security testing (DAST) technologies, or even engage in visual testing.

Some experts go even further, intentionally playing the role of adversary — a practice often referred to as white hat testing. These professionals look for security vulnerabilities that attackers might exploit to bypass defenses.

Looking back at pre-2000 software development teams — a turning point in tech history with the rise of home computing — code review was rarely practiced. Today, however, it’s expected, and professionals must always do it. Software developers have greatly improved in this regard and are now taking on greater responsibilities to ensure application security.

According to a Veracode survey from December 2016, 40% of developers already incorporate security testing during the coding phase, and 21% during the design stage. Testing early in the development process finds defects at a point when the cost of fixing them is still low, resulting in savings.

A shortage of security-focused developers

While it’s critical to focus on information security during software development, the limited talent market complicates the situation. There simply aren’t enough professionals to keep up with the growing threats. In fact, finding and retaining good software developers is already challenging — let alone keeping those with deep security expertise.

Even though it may be difficult to find software developers — especially those who take security seriously — the right kind of professionals and software engineering teams do exist. Outsourcing is a solution. Many high-quality software development providers already have the necessary security-focused mindset.

However, when outsourcing software development, make sure to hire a trustworthy team that truly prioritizes security. Ensure that your provider is proficient in security by discussing the topic from the very first meeting. Ask potential outsourcing partners to provide examples of how they make security a priority and find out which quality control codes and testing methods they use. Also, ask them to demonstrate that they’re up to date with the latest QA and testing practices.