“The State of Application Security” Research report (by Security Innovation and the Ponemon Institute)

Based on a joint research study between Security Innovation and the Ponemon Institute, here is a really interesting report that presents/rationalises the current sorry state of Application Security (in 2013).

If you are a regular reader of my blog, you shouldn't really be shocked by any of this, but, it is a good read and provides good data for management to take Application Security seriously.

Here is a quote from the A must-read report for everyone involved in software development: “The State of Application Security” article:

Still trying to find a way to get in trouble at SI :)

Humm, even with my constant leak of internal threads, push TeamMentor deadlines/releases (just to squeeze in features that I really believe are important for SI/TM) and a really strong push to 'open anything that moves' at SI, I still get this quote from Ed Adams (answering a question from an ex-boss of mine)

Ex-boss question: how is that "Crazy cowboy" doing at SI? 

(Crazy Cowboy = me)

Ed's answer: "...he's not crazy and he's no cowboy. he's a developer with seemingly boundless passion and energy who pushes us on the topic of openess beyond our comfort zone.... but we find our comfort zone ever expanding with his influence..."

I guess I need to try harder :)

(btw: if you are curious about SI's work environment take a look at Question about SI's level of openness and empowerment)

Webinar: Why Software is Still Insecure

Ed and Charles (from SI) are doing a webinar on Feb 20th about why (in most cases) the software industry have not (yet) figured out how to integrate security into the software development lifecycle (in a repeatable, measurable and visible way).

I couldn't agree more and I’m looking forward to hearing what they have to say :)

You can read more about it and register here

Ed on SecurityInnovation's focus on Application Security

Yeah it's Marketing but its actually quite a nice description of SI (Security Innovation) focus on Application Security.



One key concept are the 3 pillars of Secure SDL: Standards, Education and Assessment:














Here are a couple more videos on these 3 pilars (click on the each pillar to see them)