Learning Objectives:

  • Understand the principles of application security.

  • Apply secure software development lifecycle (SDLC) practices.

  • Implement application security testing, including SAST, DAST, and penetration testing.

  • Recognise the importance of runtime protection and monitoring.

5.1 Application Security Principles

Application security is the protection of software applications from threats throughout their lifecycle. The ECB’s SREP methodology requires that financial entities have processes to ensure that acquired (purchased) software applications and systems meet current business requirements and are aligned with the overall ICT architecture, while controlling risks stemming from deployment . Financial entities must also develop software applications in a controlled manner, ensuring alignment with the overall ICT architecture, business needs and strategy .

5.2 Secure Software Development Lifecycle (SDLC)

The secure SDLC integrates security practices into every phase of software development. The ECB’s SREP methodology requires that financial entities have a comprehensive ICT project and program management framework commensurate to their organisational set-up, activities and resources .

Secure SDLC Phases:

Requirements: Define security requirements for the application.

Design: Design the application with security in mind, including threat modelling.

Development: Follow secure coding practices and use automated code analysis tools.

Testing: Conduct security testing, including SAST, DAST, and penetration testing.

Deployment: Deploy the application in a secure manner.

Maintenance: Monitor and update the application to address security vulnerabilities.

5.3 Application Security Testing

The ECB’s SREP methodology requires that financial entities conduct ICT internal audit reviews with a frequency and scope commensurate with the risk exposure of the supervised entity . This includes testing the security of applications.

Types of Application Security Testing:

Static Application Security Testing (SAST): Analysing source code for security vulnerabilities without executing the application.

Dynamic Application Security Testing (DAST): Testing running applications for security vulnerabilities.

Interactive Application Security Testing (IAST): Combining static and dynamic analysis techniques.

Penetration Testing: Simulating attacks to test the security of applications.

5.4 Runtime Protection and Monitoring

The ECB’s SREP methodology requires that financial entities have adequate protection measures in place to safeguard ICT systems, at the network and end-point levels, for information in transit and at rest . The Regulation on Information Systems and Cyber Risk Management requires that financial institutions have procedures in place for collecting, logging and analysing security-relevant events in order to trigger actionable security alerts or initiate the security incident process .

Key Runtime Protection Controls:

Web Application Firewall (WAF): Protecting web applications from attacks.

Runtime Application Self-Protection (RASP): Monitoring application behaviour to detect and prevent attacks.

Input Validation: Validating all input to prevent injection attacks.

Output Encoding: Encoding output to prevent cross-site scripting (XSS).

PreviousNext