Application security is getting a new push as rules governing the payment-card industry mandate many businesses undergo a software code review or make use of a Web application firewall starting later this summer.

“Application security is high on everybody’s radar,” says Brad Friedman, CIO at Burlington Coat Factory, which like other businesses that handle customer payment cards is obligated to comply with Payment Card Industry (PCI) security guidelines. For Friedman, who says his company has already locked down PCs and point-of-sale devices in its 400 stores, the concern remains for companies how to avoid the kind of credit-card data-breach fiasco that TJX had last year. 

But the question is: Which of these soon-to-be PCI-required approaches to take? And even if you’re not required to go with one of these approaches, does either of them really do the trick?

Code analysis pros and cons

There’s a wide range of tools and services that help automate code analysis for purposes of finding security flaws in applications, including those from Fortify Software, Klocwork, Ounce Labs and Veracode. And there are application-penetration testing tools such as the Core Security Technologies' software Core Impact, which uses an agent-based approach.

Click to see: A look at frequency of security reviews conducted, by type, according to a Deloitte survey of 169 financial institutions.

However, many security experts point out that automated code analysis has its limits, especially when it concerns finding flaws in the underlying business logic of an application.

“Source-code analysis won’t find all security vulnerabilities,” acknowledges Brian Chess, chief scientist at Fortify, which makes tools for static-code analysis and real-time analysis of applications. “It will find a lot of vulnerabilities that can be exploited through buffer overflows, cross-site scripting and SQL injection. But source-code analysis can’t tell you about business logic flaws. It can’t find design flaws.”

Others agree.

“Closed source or open source, it comes down to the programmer and their psychology,” says Joe Stewart, senior security researcher at Atlanta-based SecureWorks. “Code inspection will find common mistakes, such as buffer overflows. But finding errors in logic is much harder.”

Business logic flaws often are made in the design of an application’s authentication process, Stewart notes. “Suppose it checks one letter at a time — it gives attackers a clue. Or a logic bug may involve giving people access to something they shouldn’t have. Programmers may skip over the critical checks so they can do it faster.”

Whitepapers

• Gene Kim's Practical Steps to Mitigate Virtualization Security Risks
• Selecting Effective Virtual Directories
• A Modern Approach to On-Demand Email and Data Security
• Best Practices for HP Servers and HP Enterprise Virtual Array in a Microsoft Exchange
• Compliance, Protection, Recovery: A Layered Approach to Laptop Security
• Endpoint Security: Data Protection for IT, Freedom for Laptop Users

View more SECURITY whitepapers

Webcasts

• Key Considerations for a Successful 802.11n Deployment
• Solutions to the Toughest IT Challenges in Remote Offices
• Lowering the Cost of Email Archives
• High Availability for SQL Server 2005 Using Array-Based Replication and Host-Based Mirroring Technologies
• Technical Overview of Exchange Server 2007 with HP Servers and Storage
• Bringing Order and Security to your Mobile Workforce: Corporate Mobility Policy and Device Management On-Demand

View more SECURITY webcasts

Special Reports

• The Evolution of Network Security
• Taking Virtualization Up a Notch
• Learn how to Keep your Mobile Workforce Connected
• The self-managed network

View more SECURITY special reports