What is Application Security?

Application security is the discipline of processes, tools and practices aiming to protect applications from threats throughout the entire application lifecycle. Cyber criminals are organized, specialized, and motivated to find and exploit vulnerabilities in enterprise applications to steal data, intellectual property, and sensitive information. Application security can help organizations protect all kinds of applications (such as legacy, desktop, web, mobile, micro services) used by internal and external stakeholders including customers, business partners and employees.

Why Application Security?

As validated by multiple studies, the majority of successful breaches target exploitable vulnerabilities residing in the application layer, indicating the need for enterprise IT departments to be extra vigilant about application security. To further compound the problem, the number and complexity of applications is growing. Ten years ago, the software security challenge was about protecting desktop applications and static websites that were fairly innocuous and easy to scope and protect. Now, the software supply chain is much more complicated considering the outsourced development, the number of legacy applications, coupled with in-house development that takes advantage of 3rd party, open source and commercial, off-the-shelf software components. Organizations need application security solutions that cover all of their applications, from those used internally to popular external apps used on customers’ mobile phones. These solutions must cover the entire development stage and offer testing after an application is put into use to monitor for potential problems. Application security solutions must be capable of testing web applications for potential and exploitable vulnerabilities, have the ability to analyze code, help manage the security and development management processes by coordinating efforts and enabling collaboration between the various stakeholders. Solutions also must offer application security testing that is easy to use and deploy.

Static Application Security Testing (SAST) scans the application source files, accurately identifies the root cause and helps remediate the underlying security flaws. Developer Benefits of Static Application Security Testing: Identify and eliminate vulnerabilities in source, binary, or byte code Review static analysis scan results in real-time with access to recommendations, line-of-code navigation to find vulnerabilities faster and collaborative auditing. Fully integrated with the Integrated Developer Environment (IDE)

Dynamic Application Security Testing (DAST) simulates controlled attacks on a running web application or service to identify exploitable vulnerabilities in a running environment. Benefits of Dynamic Application Security Testing: Provides a comprehensive view of application security by focusing on what’s exploitable and covering all components (server, custom code, open source, services) Can be integrated into Dev, QA and Production to offer a continuous holistic view Dynamic analysis enables a broader approach to manage portfolio risk (1000s of applications) and may scan legacy apps as part of risk management Tests functional app, so unlike SAST, is not language constrained and runtime and environment-related issues can be discovered

On-Premise vs SaaS Application Security Solutions

Application security solutions consist of the cybersecurity software (the tools) and the practices that run the process to secure applications. On-Premise Application security testing solutions can be run on-premise (in-house), operated and maintained by in-house teams. This approach requires organizations to provide the infrastructure, the personnel and acquire application security solutions for their usage. On-premise assures organizations that their application data is not shared with third parties and does not leave the premises. SaaS Application security can also be a SaaS (or application security as a service ) offering where the customer consumes services provided as a turnkey solution by the application security provider. This approach doesn’t require any of the prerequisites of the on-premise approach but it does require relying partially or completely on the SaaS vendor and in most cases, allow the application data to be shared with the vendor. SaaS provides an easy way to get started on application security and can offer scalability and speed. Hybrid implementations (using on-premise and SaaS together in different projects and practices) aim to provide the best of both worlds by providing flexibility, scalability and cost optimization.

What is the OWASP Top 10?

The Open Web Application Security Project ( OWASP ) is an open source application security community with the goal to improve the security of software. Its industry standard OWASP Top 10 guidelines provide a list of the most critical application security risks to help developers better secure the applications they design and deploy. Find overviews and practical tips for each of the Top 10 in A Developer’s Guide to the OWASP Top 10 .

What are Application Security Solutions?

Micro Focus Application Security solutions offer application security testing and management on-premise and as-a-service that can help companies secure their software applications including legacy, mobile, third-party, and open-source applications. The Micro Focus Fortify offerings included static, dynamic, interactive application security testing, and runtime application self-protection, as well as services to support a Software Security Assurance program, which are processes to ensure that the applications that run your business are protected and secure. The solutions include: Fortify Static Code Analyzer - Static Application Security Testing (SAST) - Identifies and pinpoints security vulnerabilities in source code early in the software development lifecycle. Fortify WebInspect - Dynamic application security testing (DAST) – Simulates real-world security attacks on a running application to provide comprehensive analysis of complex web applications and services. Interactive application security testing (IAST) – Integration of our dynamic testing and runtime analysis to identify more vulnerabilities by expanding coverage of the attack surface and exposing exploits better than dynamic testing alone. Fortify Application Defender - Runtime application self-protection (RASP) – Actively monitors and protects applications in production that have known and unknown vulnerabilities. Fortify on Demand – Security as a Service - A simple, easy and quick way to accurately test applications without having to install or manage software, or add additional resources. Mobile Security – Mobile testing methodology that tests all three tiers including the client, network and server. Software Security Assurance – Centralized management repository provides visibility that helps resolve security vulnerabilities. Fortify Software Security Center - Centralized management repository providing visibility to the entire application security testing program. It prioritizes, manages and track security testing activities and provides an accurate picture of software security risk across your enterprise. Contact us

什麼是應用程式安全性？

‹ Back

應用程式交付管理
‹ Back

應用程式交付管理
加快速度、消除瓶頸，不斷提升軟體交付能力
應用程式現代化與連線
‹ Back

應用程式現代化與連線
實現核心業務系統的現代化以推動業務轉型
安全性
‹ Back

安全性
為您所有工作的核心提供安全防護，包含營運、應用程式、身分識別與資料
資訊管理與治理
‹ Back

資訊管理與治理
值得信賴、經過法律驗證、遵循法規和隱私的解決方案
IT 作業管理
‹ Back

IT 作業管理
使 IT Operations 與 DevOps 齊頭並進
Analytics & Big Data

應用程式安全是指制定程序、工具和實務的原則，以在整個應用程式生命週期內保護應用程式避免威脅。網路犯罪分子有組織且專業，會主動找出並利用企業應用程式中的漏洞來竊取資料、智慧財產以及機密資訊。應用程式安全有助於組織保護內部和外部利益相關者（包括客戶、企業合作夥伴與員工）所使用的各種應用程式，例如傳統、桌面、網路、行動、微服務等類型。

為什麼要重視應用程式安全？

經過多項研究證實，大多數成功的攻擊行為都是鎖定應用層中可利用的安全漏洞，這顯示企業 IT 部門需要更進一步對應用程式的安全保持警戒。隨著應用程式數量增加且複雜程度不斷攀升，這問題也變得更加嚴峻。十年前，軟體安全面臨的挑戰在於保護桌面應用程式和靜態網站，這些項目通常簡單無害，且能輕鬆確定範圍並予以保護。現在，組織要考量到外包開發、傳統應用程式數量，以及利用第三方、開放原始碼與商規元件進行的內部開發等要素，這讓軟體供應鏈變得更為複雜。

組織需要的應用程式安全解決方案應能涵蓋所有應用程式，從組織內部使用的項目到客戶手機上的熱門外部應用程式，都能獲得保障。這些解決方案必須涵蓋整個開發階段，並在應用程式投入使用後進行測試，以監控潛在的問題。應用程式安全解決方案必須能夠測試網路應用程式是否存在可能被利用的漏洞、能夠分析程式碼、透過協調工作和促進各利益相關者之間的合作來幫助管理安全和開發管理流程。這些解決方案還必須提供容易使用及部署的應用程式安全測試。

何謂 SAST 與 DAST？

何謂 SAST？

靜態應用程式安全測試 (SAST) 可掃描應用程式的原始程式檔，精準地找出安全問題的根本原因，並幫助修復其中暗藏的安全漏洞。

靜態應用程式安全性測試為開發人員帶來的優勢包括：

辨識並排除原始碼、二進位檔或位元組碼當中的弱點，
且即時檢查靜態分析掃描結果並提供建議與程式碼行瀏覽，以更快找到弱點並實現協同稽核。
完全整合於整合式開發人員環境 (IDE)

何謂 DAST？

動態應用程式安全測試 (DAST) 會以可控管的方式對執行中的網路應用程式或服務模擬攻擊，找出執行中環境內可利用的弱點。

動態應用程式安全測試的優勢包括：

聚焦於可利用的弱點並概括測試所有元件（如伺服器、自訂程式碼、開放原始碼、服務等），完整掌握應用程式安全性
可整合於開發、品管和生產環境當中，以持續提供全方位檢視
動態分析的產品組合風險管理覆蓋範圍更廣（可管理數千個應用程式），且在管理風險的過程中會一併掃描傳統應用程式
可測試功能應用程式，不像 SAST 一樣會受到語言限制，還能夠發現與執行階段和環境相關的問題

內部部署與 SaaS 解決方案

應用程式安全解決方案包含網路安全性軟體（工具），以及可執行相關程序來保護應用程式的實務。

內部部署

應用程式安全測試解決方案提供內部部署（內部作業）執行模式，可由組織內部的團隊進行維運工作。這種執行方式需要組織提供基礎架構和作業人員，並購買應用程式安全解決方案以供使用。內部部署進而能確保第三方無法共享組織的應用程式資料，而組織也不必離開內部環境進行操作。

SaaS

應用程式安全解決方案也可能是 SaaS 產品（或以應用程式安全為服務），在這類應用中，應用程式安全供應商能夠以服務方式為客戶提供面面俱到的解決方案。採用這種方式時，組織不用滿足內部部署方式的必要條件，但需要一定程度或完全依賴 SaaS 供應商。在大多數的情況下，組織也必須允許供應商共享應用程式資料。 SaaS 可協助組織輕鬆開始建立應用程式安全性，並滿足所需彈性與速度。混合式實作（在不同專案和實務中結合使用內部部署及 SaaS）能夠同時針對兩種執行方式提供靈活性、延展性並盡可能降低成本，讓客戶享有兩全其美的解決方案。

速度與準確性

如今，每個業務層面都離不開軟體。網路和行動應用程式的數量也因此大幅增長，而應用程式發行的頻率越趨頻繁。許多組織往往會犧牲偵測重要漏洞所需的準確性，選擇執行範圍較小的安全性掃描以滿足業務需求。安全解決方案應具備敏捷度，足以讓組織進行全面且精準的安全掃描，同時又能避免可能造成修復失敗的相關誤報結果。

何謂 OWASP 前十大資安弱點 (OWASP Top 10)？

OWASP 前十大資安弱點 (OWASP Top 10)

開放網路應用程式安全專案 (OWASP) 是一個致力於提高應用程式安全的開放社群，其主要目標是研議協助改善軟體的安全。 OWASP 前十大資安弱點 (OWASP Top 10) 產業標準指南會列出最重要的應用程式安全風險，以幫助開發人員設計和部署的應用程式獲得更好的保障。 OWASP 前十大資安弱點開發人員指南會概述前十大安全風險，並針對每項風險提供實用技巧。