Downloaded 33 times
More Related Content
Similar to Rational application-security-071411
Rational application-security-071411
- 1. IBM Security SolutionsIBMRational Application Security
- 2. 2AgendaCurrent Trends inApplication SecurityThe SolutionStrategies for Customer SuccessRational AppScan SuiteIBM Application Security Coverage
- 3. Executive SummaryWeb applicationsare the greatest source of risk for organizationsRational Application Security enables organizations to address root cause of this riskAppScan leverages a mix of technologies (static & dynamic)AppScan is a key part of IBM Security’s full solution view of application security 3Rational AppScan SuiteenablesComprehensive Application Vulnerability Management
- 4. The Costs fromSecurity Breaches are Staggering4285 Million records compromised in 2008Verizon 2009 data Breach Investigations Report$204 Cost per Compromised RecordPonemon 2009-2010 Cost of a data Breach ReportTranslates to $58.1BCost to CoRporations
- 5. Sources of SecurityBreach Costs5Unbudgeted Costs: Customer notification / care
- 6.
- 7.
- 8.
- 9.
- 10. Cost torepair1,000,000x10x1xSecurity FlawDamage to EnterpriseFunctional FlawDevelopmentTestDeployment
- 11. Web Applications arethe greatest risk to organizations6Web application vulnerabilities represented the largest category in vulnerability disclosures
- 12. In 2009, 49%of all vulnerabilities were Web application vulnerabilities
- 13. SQL injection andCross-Site Scripting are neck and neck in a race for the top spotIBM Internet Security Systems 2009 X-Force®Year End Trend & Risk Report
- 14. Why are WebApplications so Vulnerable?7Developers are mandated to deliver functionality on-time and on-budget - but not to develop secure applicationsDevelopers are not generally educated in secure code practicesProduct innovation is driving development of increasingly complicated software for a Smarter PlanetNetwork scanners won’t find application vulnerabilities and firewalls/IPS don’t block application attacksVolumes of applications continue to be deployed that are riddled with security flaws… …and are non compliant with industry regulations
- 15. 8Clients’ security challengesin a smarter planet Key drivers for security projectsIncreasing ComplexityRising CostsEnsuring Compliance Spending by U.S. companies on governance, risk and compliance will grow to $29.8 billionin 2010Soon, there will be 1 trillionconnected devices in the world, constituting an “internet of things”The cost of a data breach increased to $204 per compromised customer record Source http://searchcompliance.techtarget.com/news/article/0,289142,sid195_gci1375707,00.html
- 16. Market DriversRegulatory &Standards ComplianceeCommerce: PCI-DSS, PA-DSSFinancial Services: GLBAEnergy: NERC / FERCGovernment: FISMAUser demand Rich application demand is pushing development to advanced code techniques – Web 2.0 introducing more exposuresCost cutting in current economic climate Demands increased efficienciesCyber Blitz Hits U.S., Korea Websites -WSJJuly 9th, 2009“Web-based malware up 400%, 68% hosted on legitimate sites” — ZDnet, June 2008Hackers Break Into Virginia Health Website, Demand Ransom — Washington Post, May, 2009
- 17. 10AgendaCurrent Trends inApplication SecurityThe SolutionStrategies for Customer SuccessRational AppScan SuiteIBM Application Security Coverage
- 18. The Solution -Security for Smarter ProductsSmarter Products require secure applications
- 19. Security needs tobe built into the development process and addressed throughout the development lifecycle
- 20. Providing security forsmarter products requires comprehensive security solutions deployed in concert with application lifecycle management offerings that:
- 21. Provide integrated testingsolutions for developers, QA, Security and Compliance stakeholders
- 22. Leveragemultiple appropriate testingtechnologies (static & dynamic analysis)
- 23. Provide effortless securitythat allows development to be part of the solution
- 24. Supportgovernance, reporting anddashboards
- 25. Can facilitate collaborationbetween development and security teams11
Editor's Notes
- #4 Web applications are the greatest source of risk for organizations today. And Rational application security can allow organizations to address the root cause of this risk. That’s a significant statement because there are different application security solutions out there that are more protection and patch that don’t address the root case. recard). We leverage a mix of technologies both static and dynamic to enable the right use cases. So not only do we speak to the technologies but we focus on building the right solution for the right stakeholder whether you’re talking to a security auditor, build manager, developer, QUA tester. We’ve built our portfolios to support these different - these cases. And beyond that AppScan is the key part of IBM’s full solution view of application security so we’re not just a point solution like many of thetier two competitors that we see in the market. We’re a full solution for application vulnerability management but we’re also full solution for application security from vulnerability management to identity and access management to application firewalls and IPSs. So there’s a full story that we’ll get into shortly but in summary: we’re a comprehensive application vulnerability management solution.
- #5 some new stats that may be new to your customer f they’re not already aware of the severity and prevalence. Verizon business report, in their report from 2009 they found that there were 285 million records that were compromised. We married this data point with Ponemon’s research that cost of a compromised record cost to an organization is $204 per record and that translates to over $58 billion cost to corporations. That’s a pretty significant problem and one that CIOs, (CSOs) can’t ignore
- #6 There’re multiple sources of breach cost but the key point on this slide is that you should fix security issues early in the process. If that doesn’t happen, if this gets in the field and there’s a breach as a result, the cost of a security flaw is exponentially higher then what is typically seen for a functional flaw. And these cost organizations come in in many different forms from government litigation, brand damage, revenue, cost repair and audits
- #7 More data from IBM X source year end report. About half - Web application vulnerabilities is the largest category. Vulnerability disclosures represent about half of all vulnerabilities that exist for the organization.
- #8 Why are applications so vulnerable? Developers are mandated to deliver functionality on time and on budget, not to develop secure applications. So security is not a priority for them. They’re also not generally education in secure code practices. Additionally, product innovation, the whole smarter planet discussion is driving development of increasingly complex software. We’re all over that. When developers limits are being stretched, they’re focusing on the functionality of those applications, not the security, and increasing complexity generally increases risk within these applications. And of course the discussion that we continue to see, network scanners don’t find application vulnerabilities and the firewall IPSs don’t block application attack. So what’s happening is that we just continue to see volumes of applications that are deployed which are riddled with security flaws and they’re also non-compliant in industry regulations.
- #9 These new risks are significant drivers for security products. There’s increase in complexity. And then of course, compliance continues to be a main focal point in these discussions.
- #12 Security should be build into the development process vs. bolted on. Testing for vulnerabilities should be a seamless part of development that happens throughout the development lifecycle.Integrated testing solution for developers, QA, Security and Compliance stakeholdersIntegrated solution that allows for testing at all steps of Software Delivery from coding, build, QA, audit to production. Leverage best of both leading testing technologiesSolutions leverage a combination of Blackbox + Whitebox technologiesEffortless Security Developers should not have to be security experts Tools should be easy to configure, results should be accurateGovernance, reporting and dashboardsCentral control over test policiesVisibility through dashboards and reportsFacilitate collaboration between development and security teamsIssues can be assigned and tracked