Effective Software Security Management

Few excerpts from my white paper on 'Effective Software Security Management'

If you wonder “What makes secure software different?” you would realize that security is an innate property of the software which was expected to be built in. Unfortunately, most of applications lack security today. The traditional practices used to develop outsourced applications are no more effective. Even the Indian IT services companies lag in improvising their SDLC at the same pace with the global industry. One of the weakest areas where these companies fall is Software Security. Current business environment is fraught with risks. The applications demand tight software security embedded inside to prevent hackers getting in. To incorporate software security measures, enterprises need to change their existing application development lifecycle.

The current scenario is such that many companies to an extent have started addressing security earlier in the lifecycle to mitigate the risks of application security attacks. But, there is still room for improvement. The application security landscape is changing rapidly.

Customers outsourcing applications need to ensure the application development lifecycle of the IT services provider embark software security inline. The IT services companies on the other hand need to develop confidence in the customer for software security levels in their SDLC.

Maintaining a high level of security is no simple proposition. One of the key issues with outsourced applications is that unlike functional concerns, non-functional concerns of application like security and performance are always given lower priority. If the services companies fail to understand the importance of these non-functional factors, the customer is at loss. At the end, if these security defects are injected due to lack of measures taken during SDLC, it may destroy customer value and trust.

Growing Demand of Moving Security Higher in SDLC

Application Security has emerged as a key component in overall enterprise defense strategy. Companies that build a strong line of defense usually learn to think like an attacker. Often is a developer is asked to wear two hats: one as developer that works in complex distributed environments, and the other as a security expert who builds software security. Organizations that understand application security practices and priorities are using resources far more effectively than in years past, while avoiding costly and potentially crippling problems.

In the years past, anti-virus software, firewalls, intrusion detection and intrusion prevention systems have been successful enough to protect network and hosts. While still the bulk of attacks happen at network layer, attackers have been successful compromising the application with lower ratio of making applications as targets. The industry reports of organization suffering application attacks with significant downtime in the application or loss of customer data. Financial institutions, Healthcare providers, Retailers, Telecom Industry or even IT Companies have not been able to get escaped from becoming a victim of application attacks. The impact of these attacks have been damage to their brand name, loss in revenue, loss of customer data, system or network downtime and even legal issues with compliance to PCI (Payment Card Industry) or SOX (Sarbanes-Oxley) standards.

In the current world, software security assurance needs to be addressed holistically and systematically in the same way as quality and safety. Most of the assurance can be driven by improved software development practices. It is also important to realize that the security cost factor increases as you move down the SDLC.

Leading Change

Hello All....

I have been taking a few lectures on 'Change Management in Enterprise' in one of the management institutes in Mumbai. We talked about McKinsey's Principles and Lewin's Principles for Change Management. Then I came across this wonderful piece on Leading Change from John Kotter.

John P. Kotter, a world-renowned expert on leadership at Harvard Business School, has been the premier voice on how the best organizations actually “do” change.

This is what he says...Hope people interested would enjoy as I did. In the world of IT, even inclining organizations to look into Security requires a 'Change'. Let us all try and achieve the BEST CHANGE. :)

Why do we need leaders?

Leadership is required for mobilising people to handle challenging times. In a world that has no challenges, things are fine and you don’t require leaders. In such a world, you don’t need to mobilise people for handling any crisis. But unfortunately, in our world, we a have huge number of challenges in the government, non-profit and business sectors; we have many challenges in the developing and the developed world. Hence, we require leadership in our world. In fact, in our world, the need for leadership is more now than ever before. In our current world of business, we cannot afford to restrict leadership to just the top management positions. Every employee, every engineer should rise to a leadership role. They should step in to solve customer problems; they should step in to solve internal company problems. The number of people that we need to provide leadership is huge now. The turbulences in life will never stabilise, and I see the demand for leaders going up steadily.

How are leaders different from managers?

Leaders mobilize people. Their role is to undertake challenging goals that involve change. Leaders focus on changing behaviour, while managers focus on existing circumstances. For example, if there is a DVD player that is built well, we don’t require a leader to press the on/off button, because there is no challenge in it and no change is involved. I am not saying that managers are not important. Of course, they are important since it is not just the story of one DVD player. It is the story of 100,000 DVD players in 20 different countries where things can get complicated. Managers are important in that they should manage all these different DVD players in different countries, and ensure that they play the right movies at the right time. But the role of leaders is different. They often create the systems that the managers manage. For example, initially, there was the VHS system and the tapes that we were used to. It took leadership to change the user habits into something better. In the case of the battle between Sony and VHS, the amount of leadership that was required initially to drive the battle was much greater than after they won. Leadership is important at times of change because most of the time, the systems are not in place and leaders drive change and face challenges that are humongous. In short, in the case of stable existing systems, you need managers, while in the case of new turbulent situations that require a change, you need leaders.

Do leaders always drive change?

Almost always, leadership produces change. Go back in history and read about the people who were great leaders, and you will see that they were always focused on change. They were always helping people to change their behaviour. They were always focused on changing systems. Look at Mahatma Gandhi — he induced change in Indian society: he mobilised Indians and changed the way they looked at their state of affairs.

Do leaders drive their selfish cause or altruistic cause?

More often, people are talking about the behaviour of people when they are talking about leadership. They think about the presidents or CEOs of companies when leaders are mentioned. That is not the right way. The belief is that people in those positions mobilize people. But, the reality is that most of the times they are just politicians, managers, or sometimes they are not good at any of these. That is not a good way of defining leadership.

Good leaders are always driving changes. They derive a sense of satisfaction out of the change they drive. Great leaders always do something for people. I call it altruistic because it is good for the people. They are progressing towards goals that the society needs.

What is India’s role in shaping effective future leaders?

India is becoming very important and has got a bigger role to play in the global economy. Offering services cheaper and better is not the end; it’s the beginning. You must lead the way. You need good leaders for that, but more often than not, you don’t get better leaders. Educational institutions should focus on mentoring good leadership.

Is Software Security Testing Complicated?

Testing software for Security is something that can be quite complicated to do. Those that do test software are also those that have taken classes and know just what it is that they are doing.

If you are all into software, and are very familiar with it, as well as interested in testing it yourself, you are going to want to check out the software testing course that is held closest to you.
Many companies hire a 3rd party to give their employees a security testing course or build an in house team for providing this as a special service to teams across the organization.

I somehow believe that Security testing is something that comes a little easier to someone that understands or has written a software program before. If you have ever written a software application and are looking to get into testing, you are going to find that learning what you need to know to test will be easier for you than someone else.

Riding the Third Wave

Introducing - TechTrails

Dear Software Professional ,

So the rupee’s rising. Now why’s that causing sleepless nights for some software exporters? And hey, what’s the net impact on you? . Does this rise of the rupee present a great opportunity that could have far-reaching positive consequences ? What is the future of Indian IT industry ? What will happen when other low cost destinations for outsourcing catch up with India ? Will India sustain it’s cost advantage ? These are questions that impact your career and you need an answer on how and what you need to do to get ready for the next wave of Indian IT .


www.techtrails.com has the answers for you .


This is the only web portal of it’s kind that will help you as a IT professional or a student planning a career in IT to get ready for the future . Thought leadership articles , interviews with industry leaders , tips and tricks , white papers www.techtrails.com has it all . Besides you would get invited to free seminars and panel discussions on topics that would impact you .

Over time the www.techtrails.com would be a place for 3rd wave Indian IT professionals to hang out , exchange information , share links to their blogs , upload content that would be of benefit to all who are a part of this community .


Registration to www.techtrails.com is Free ! Rush and register yourself to www.techtrails.com Now !