Special Offer w/ OnDemand or vLive: Get a 12.9" iPad Pro, Surface Pro, or $350 Off - Top Offers of 2018


Subscribe to SANS Newsletters

Join the SANS Community to receive the latest curated cyber security news, vulnerabilities and mitigations, training opportunities, and our webcast schedule.

It Takes a Village: Results of the 2016 SANS AppSec Survey

Apps, particularly web apps, cause of 23% of damaging breaches/loss of sensitive data - Programs are Improving

  • Bethesda, MD
  • April 20, 2016

It takes a village to securely manage applications, based on results of a new survey to be released by SANS Institute during a 1 PM EDT webcast on April 27, 2016.

"The diverse respondents to our latest application security survey show why so many application security programs are struggling," says application security (AppSec) expert Johannes Ullrich. "They often have to work effectively throughout multiple silos within the organization. To make a difference, they need to be able to not just affect application code quality, but configuration as well."

It is critical for an overall enterprise security program to coordinate among developers, architects and system administrators - particularly with many software vulnerabilities being rooted in configuration issues or third-party components, not just in code written by the development team.

Survey respondents recognize these needs and are making improvements. In the survey, 67% of respondents are now partially integrating AppSec into their overall security, risk management and incident response programs, and 17% fully integrate these processes. They are making improvements despite a lack of application security skills and lack of funding and management buy-in, which were the top two issues cited by respondents.

"Organizations are still struggling to find individuals with the right skill set to perform the challenging task of creating and managing application security program," Ullrich continues. "The fact that they are doing more with less shows that application security processes and products are improving."

Full results will be shared during a April 27, 2016, webcast at 1 PM EDT, sponsored by Checkmarx, Veracode, and WhiteHat Security, and hosted by SANS. Register to attend the webcast at www.sans.org/webcasts/101462

Those who register for the webcast will also receive access to the published results paper developed by SANS Analyst and application security expert, Johannes Ullrich.

Tweet this:

Apr 27: 2016 Survey update on the status of application security. Register: www.sans.org/u/gvP #InfoSec #AppSec

How have orgs improved application security practices in last year? On 4/27 www.sans.org/u/gvP #InfoSec #AppSec

Learn what your colleagues have determined are the most useful #AppSec processes/tools. 4/27 webcast: www.sans.org/u/gvP

About SANS Institute

The SANS Institute was established in 1989 as a cooperative research and education organization. SANS is the most trusted and, by far, the largest provider of cyber security training and certification to professionals at governments and commercial institutions world-wide. Renowned SANS instructors teach over 60 different courses at more than 200 live cyber security training events as well as online. GIAC, an affiliate of the SANS Institute, validates a practitioner's qualifications via over 30 hands-on, technical certifications in cyber security. The SANS Technology Institute, a regionally accredited independent subsidiary, offers master's degrees in cyber security. SANS offers a myriad of free resources to the InfoSec community including consensus projects, research reports, and newsletters; it also operates the Internet's early warning system--the Internet Storm Center. At the heart of SANS are the many security practitioners, representing varied global organizations from corporations to universities, working together to help the entire information security community. (https://www.sans.org)