Home / Knowledge hub / Application security
Knowledge hub
Application security
Keeping the software you build and run from being abused.
What it means
Application security means keeping the software you build and run from being abused: the code, the login, the permissions, the data it holds. It asks one question of every feature. What happens when somebody uses this in a way you did not intend?
Network and device security are separate disciplines. They cover the pipes and the laptops, and you need both. Neither one can see a flaw in a feature that works exactly as written.
Why it matters
Your application is the part of the business customers touch, and the part that holds their data. It also changes every week, so a security answer that held at the last release does not automatically hold at this one.
It is the one category where the fix belongs to you alone. No appliance repairs a missing permission check. Somebody on your team has to change a line, which makes finding the line the expensive part.
Ownership slips here more than anywhere else. Hosting belongs to somebody and laptops belong to somebody, while the application belongs to whoever shipped the last feature. That lasts until a deal pauses over a security questionnaire.
How it shows up
In practice it comes down to a short list you meet again and again. Who can reach what. What the application does with input from outside. How it handles secrets and sessions. What you inherit from your libraries. Whether the settings in production match the ones in your head.
Each of those has a test you can run repeatedly rather than once a year. Cyberlop works across ten vulnerability classes on that list. See what the platform covers.
Questions people ask
Application security, answered
What is the difference between a penetration test and a vulnerability assessment?
A vulnerability assessment lists what might be wrong. A penetration test tries it and shows you what worked. The first produces a longer document and the second a more useful one.
Ask which you are buying before you sign. The words get used interchangeably and the prices do not.
We have a web application firewall. Is that not enough?
A firewall in front of your app blocks traffic that looks like an attack, which buys time and filters noise.
It cannot tell that this logged in user should not be reading that record, because the request looks entirely normal. Run it beside the fixes rather than instead of them.
My developer says our security is fine. How would I know?
Ask for the evidence instead of the opinion. A finding that comes with a request, a response and the line of code is checkable by anyone, including a developer who disagrees.
That is why we ship proof with every finding. See what we hand over.
Are security flaws acceptable if not much harm can come from them?
Sometimes, and saying so out loud is healthier than pretending otherwise. Some findings genuinely are not worth holding a release for.
Write down the decision, the reason and who made it, then revisit when the feature changes. A risk you accepted on purpose is a different thing from one nobody noticed.
How do I justify the spend to the people holding the budget?
You cannot measure a breach that did not happen, so do not try. Measure the parts you can see: deals that stalled on a security questionnaire, hours spent answering one, rework when a flaw turns up late.
For most teams the questionnaire time alone carries the argument.
Sources
Where this comes from
Related
Terms that sit next to this one
Access control
The rules deciding which person can see or do which thing in your app.
OWASP Top 10
A widely used list of the ten most critical web application risks.
Penetration test
A time-boxed engagement where skilled people attack your systems by hand.
Vulnerability
A weakness that somebody could use to cause harm.
Threat model
Asking what is worth taking, who wants it, and how they would try.
When did you last test it?
A network scan says nothing about the software you wrote. We test one application across ten vulnerability classes and prove each finding. Thirty days on one application costs $199.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.