Credits : Itproportal

Credits : Itproportal

 

It has become commonplace to hear multiple news stories about major technology companies and zero-day vulnerabilities in the products or services they provide.  What often seem to resurface from customers and the press are comments questioning a technology company’s commitment to software security assurance.  Software security assurance requires a development organization to create and apply a set of methods and processes that ensure that software functions as intended and does not include vulnerabilities, malicious code, or defects that can bring harm to the end user.  Software security assurance is arguably one of the most important and least understood areas of software development.

Everyone is looking for a culprit to blame for security vulnerabilities.  We have found the enemy and it is NOT us.   Instead, it is our – the industry’s – approach to the software security process that needs to be reassessed.  We need to approach the security challenge with fresh eyes and ideas. There are preemptive measures within our reach to help diminish threats; we can and should proactively pursue them.

I believe we are at a critical juncture in our technology and business timeline.  We need to take a broader view of the forces at play and accelerate focus on security among the stakeholders involved.  We at SAFECode, a global, industry-led effort to identify and promote best practices for developing and delivering more secure and reliable software, hardware and services, have developed the following three strategies — the Software Security Assurance Triangle — that are critical to implement to reduce security vulnerabilities.

1. Secure Software Development Must be a Holistic Process

It is widely understood that the organization that develops software for applications, products, or services has the responsibility to adopt a holistic secure development process to minimize the risk of vulnerabilities in the code they create. In the 15 years since Bill Gates issued his Trustworthy Computing memo, the focus of development organizations on preventing, detecting and promptly addressing vulnerabilities in their code has drastically improved. No responsible organization with a long history of developing software would ignore or hide critical vulnerabilities in their code. If vulnerabilities remain, they are the result of legacy design decisions, the complexity inherent in feature-rich products and services, or sophisticated exploitation of highly complex software architectures. When such vulnerabilities are reported, they are addressed with security updates in a prompt and effective manner. More importantly, such vulnerabilities provide feedback that is used to update software security processes, tools, and training and reduce the likelihood that similar vulnerabilities will occur in the organization’s software in the future.

We should be very clear: the existence of vulnerabilities in software results from the complexity of modern software. Most mature development organizations have made investments to address software security that have made attackers’ task of finding exploitable vulnerabilities much harder. That said, there are commitments and actions by stakeholders other than the development organization – summarized below – that can significantly contribute to improving the overall state of software security assurance.

2. Today’s Software Developer Needs Security Knowledge 

The market can be powerful but the software security problem cannot be fully addressed if we ignore its roots. The digital economy runs on software and needs more and more developers. Every year, hundreds of thousands of software developers join the workforce without even a basic knowledge of security. The burden of educating and training developers on software security is left to the development organizations that hire them. This is an important point because developers play a critical role in software security assurance; in today’s IT landscape this role has never been more imperative.

While development organizations can and should train their employees on company-specific tools and processes, a basic understanding of software security and the sources of vulnerabilities is as fundamental as other aspects of computing such as data structures.  You cannot become a structural engineer without being trained on fire safety for structural members, but you can earn a software engineering degree without being exposed to basic concepts of software security. Colleges, universities, coding boot camps and other developer training organizations must address the security education of software developers or the software security problem will persist for decades to come.

At SAFECode we have released a number of free resources including industry-developed white papers and online training to support developers’ efforts to create more secure software. But we would also like to cooperate with the software engineering education community to help integrate basic concepts of software security into all developers’ education.

3. The Technology Consumer Must Demand Security Assurance

We should not underestimate the power of the market. Technology consumers play a key role in driving vendors to adopt a holistic secure development process. They own the budget and have the power to pressure their vendors. However, to be effective and avoid diverting vendors’ efforts into producing compliance documents rather than secure software, it is critical that technology consumers assess their vendors using international standards or industry frameworks that focus on the actual application of rigorous secure development processes.

Technology consumers also have a responsibility for protecting their own systems. They must understand and manage the risk associated with their systems and the products they acquire, and they must operate and administer their systems securely; including, for example, installing security updates on a timely basis, changing default passwords, and holding their users accountable. And if they find that the products and services they are using make any of those tasks difficult or impossible, they should provide clear feedback to their suppliers.

Triangulating On The Triangle

Over the last 15 years, development organizations have made a great deal of progress in articulating and applying approaches to building secure products and services. While stakeholders must acknowledge that security vulnerabilities will never be completely eradicated, they should also understand that they can be significantly reduced in prevalence and severity if:

  1. Development organizations adopt a holistic secure development process
  2. Software developers are taught security as part of their software engineering education.
  3. Technology consumers insist that their vendors adopt a secure development process help

SAFECode provides resources for assisting all software security stakeholders in executing such a strategy: practices for development organizations, training modules for developers and an assessment framework for technology consumers.

I invite all development organizations, educational institutions and technology buyers to join SAFECode in continuing to advance the Software Security Assurance Triangle.  I look forward to your response and encourage you to provide your input and insights.

Steve Lipner, Executive Director, SAFECode 

This article is shared by www.itechscripts.com | A leading resource of inspired clone scripts. It offers hundreds of popular scripts that are used by thousands of small and medium enterprises.

 

Credits : Indianceo

Credits : Indianceo

 

Despite being loaded with some great features Xamarin keeps a low profile when it comes to mobile app development. The framework has got a global acceptance by the  development community. It has over 1.4 million and growing base of developers who hail from 120 countries. Let’s take into account what makes Xamarin a great cross platform app development framework.

Native User Interfaces

Built with a native user control, Xamarin apps exhibit better accessibility and performance. Across all targeted platforms, be it iOS, Android or Windows Phone, users can dig deeper and deeper into the app features and functionalities and perform the act they want. So Xamarin makes your app engaging and intuitive and increases the conversion prospect.

Native API Access

Accessing an array of native API levels on Android, iOS and Windows Phone, Xamarin allows users to make the most of the capabilities of the device — such as sensors, touch inputs, — as well as that of the operating system’s. Furthermore, Xamarin makes it easier to harness the capabilities of Beacons and Android Fragments, the third-party products or services.

Native Performance

Gaming or media-intensive apps can be built with Xamarin. The built app can leverage the hardware acceleration capabilities (GPUs, or Graphic Processing Units) built with the device to let the gaming app perform at its best

More Types, Less Typing

Xamarin speeds up development, testing and delivery. Thanks to its innate C# Type Inference. So, skipping the manual coding, particularly those associated with cumbersome strings, developers can build their mobile app. It’s no surprise that less code will also cut the probability of programming errors.

Stronger Types, Smarter Tools

The System.Collections.Generic namespace comprises of interfaces and classes that define generic collections. This empowers users to create strongly typed collections with better type safety and performance than non-generic strongly typed collections.

Language-level Async

As we go more and more into the app-dominated economy, asynchronous programming becomes a must. It helps with building responsive apps, thereby enabling users to access the app across a range of networks with varying strength. Irrespective of the language preference – Objective-C, Swift or Java – developers can make use of callbacks and manual bookkeeping to make their app responsive.

First-Class Functions

The creation of delegates and expression tree becomes easier with C# in Xamarin owing the simplicity associated with the lambda expression. This is a breakthrough achievement as in Android and Objective-C it was either unavailable or too complex to use. This helps cross platform app developers to successfully meet the requirements of the clients building a feature-rich app.

Looking for a mobile app development company that can build app with Xamarin? If yes, look no further! This article contributor Root Info Solutions has got the expertise and experience both to do justice with your requirements.

This article is shared by www.itechscripts.com | A leading resource of inspired clone scripts. It offers hundreds of popular scripts that are used by thousands of small and medium enterprises.

Credits : Adtmag

Credits : Adtmag

 

A Gartner Inc. analyst, noting a low number of mobile apps being created for the enterprise, indicated that frustration with native and hybrid app development may be causing a growth in mobile Web apps to meet demand.

For the second year in a row, Gartner has issued research that reflects anemic enterprise mobile app development, despite a supposed big demand for such apps in the face of a developer shortage that led CNNMoney to declare a mobile app developer had “the best job in America.”

“More than a quarter of enterprises globally have not built, customized or virtualized any mobile apps in the last 12 months,” Gartner said in a news release publicizing the for-pay report “Survey Analysis: The Mobile App Development Trends That Will Impact Your Enterprise in 2017”.

While Gartner said that number is surprisingly low, it corresponds to findings in a similar report issued last year that found lagging enterprise spending for mobile apps.

“Demand for mobile apps in the enterprise is growing, but the urgency to scale up mobile app development doesn’t yet appear to be a priority for most organizations,” said analyst Adrian Leow at the time. “This must change, particularly given employees often have the autonomy to choose the devices, apps and even the processes to complete a task. This places an increasing amount of pressure on IT to develop a larger variety of mobile apps in shorter time frames.”

Leow expressed similar sentiment about the company’s new research, using some of the same exact words.

“Application leaders must turn around this trend of stagnating budgeted spend on mobile app development, as employees increasingly have the autonomy to choose the devices, apps and even the processes with which to complete a task,” said Leow. “This will place an increasing amount of pressure on IT to develop a larger variety of mobile apps in shorter time frames.”

Surveyed organizations that have undertaken mobile app development have on average deployed eight mobile apps to date, Gartner said, which is about the same as last year. Also, while an average of 2.6 mobile apps are currently under development, a much larger average number of 6.2 apps are planned over the next year.

However, Leow said, a large percentage of those planned apps will be mobile Web apps, and he indicated native/hybrid development frustration may be the cause of that shift.

“It’s encouraging to see significant growth in the number of mobile apps that are planned, but most of this growth is in mobile Web apps as opposed to native or hybrid mobile apps,” said Leow. “This indicates that some enterprises may be frustrated with developing mobile apps and are instead refocusing on responsive websites to address their mobile needs.”

Other highlights of the survey as detailed in the news release include:

  • 52 percent of respondents have begun investigating, exploring or piloting the use of bots, chatbots or virtual assistants in mobile app development.
  • The primary barriers to mobile initiatives are resources related — lack of funds, worker hours and skills gaps.
  • 68 percent of organizations are expecting to increase spending for mobile apps.
  • The average proportion of the overall software budget for mobile app development is only 11 percent.

“Many IT teams will have significant backlogs of application work that need completing, which increases the risk of lines of business going around IT to get what they want sooner,” said Leow. “Development teams need to rethink their priorities and span of control over mobile app development or risk further erosion of IT budgets and the perceived value of IT development.”

The report’s findings probably don’t come as a surprise to Gartner, which in 2015 predicted that market demand for mobile app development services would grow at least five times faster than internal IT organizations’ capacity to deliver them, by the end of 2017.

Gartner has previously advised organizations interested in speeding up the release of business-to-enterprise apps to:

  1. Prioritize your app development so you don’t sacrifice app quality and positive ROI when increasing app delivery speed. The mobile development team needs to formulate a process of mobile app prioritization that involves understanding the needs of business stakeholders and defining common criteria for evaluating mobile app projects.
  2. Adopt a bimodal IT approach to create an agile API layer. This will optimize mobile integration and simplify the process of connecting mobile apps to many different types of data sources.
  3. Encourage adoption of rapid mobile app development (RMAD) tools across the organization to increase the number of apps delivered, and select a small subset that corresponds to organizational needs.
  4. Adopt a mixed-sourcing approach for mobile app development, as some complex and specific app development activities may be more efficiently handled by an outsourced third party.

 

This article is shared by www.itechscripts.com | A leading resource of inspired clone scripts. It offers hundreds of popular scripts that are used by thousands of small and medium enterprises.