Happy New Year – Have you made your application testing resolution yet?

Now that we have come upon the new year, it is time to resolve to statically test (code review) and dynamically (penetration test) test your applications.

You may be saying to yourself that we do not need to do one or both of these tests, but why? Applications are being attacked with a passion from all sides, including from the inside of your company. Individually, neither type of test can find all of the vulnerabilities in your applications, so by not doing both, there will be vulnerabilities you have missed.

If you do have these tests done (one or both), make sure to fix the problems (vulnerabilities) that are discovered. Do not assume that they will not be taken advantage of at any time in the future. We have often heard “Oh, this application is only available internally, nothing will happen” or even “No one can take advantage of that vulnerability” or even better “We will just wait to fix it when we have time”.

How can you be sure that no one will find the vulnerability? NetSPI has some smart people, but the bad guys also have some smart people. If we can find the vulnerability, given enough time, someone else will also find it. When they do find them, what will they do with it? Steal your information, steal some money, or even worse, ruin your reputation.

Will you ever have time to fix these vulnerabilities? These may be put on your list of fixes, but priorities change and marketing may put something on the list that just absolutely has to be added to the application; there goes your time to fix the problems.

Now say after me, “I will have my applications code reviewed and pen tested this year.”