The Crucial Security Gap Within Software Applications

cybersecurity

A key aspect of modern software inhibits traditional data protection efforts

In many organisations, it is all too easy for the technical implementation of data protection to fall through the cracks. In concept, many different functional areas have a vested interest in this: compliance officers, cybersecurity teams, the CTO’s organization, business units, and more. In practice, however, most of the functions on the business side of the house lack the technical know-how to make data protection happen.

Surprisingly—for reasons explained below—the same is true even for some of the functions specifically dedicated to protection. Typically, neither compliance experts focused on privacy nor security personnel defending the network have enough specific context to truly know what is happening to the data being used within enterprise applications.

This situation dictates that both the responsibility for implementing data protection and the empowerment to carry it out should be given to application owners and the development teams that support them. Within software companies, these application owners are enterprise architects and other project leaders who balance business considerations with technical ones. For other organisations, these duties belong to solutions architects and similar professionals whose work centers on rolling out and maintaining software, whether purchased from a third party or developed in house.

Explaining the Gap in Software that Impacts Data Protection

To grasp the specific hurdles that application owners and developers face, it is important that all stakeholders understand a prevalent but subtle issue within modern apps that makes data protection such a challenge. The issue is the critical technical gap—sometimes more like a chasm—between the end users and the database “users” of an application.

Consider this common scenario: A consumer-facing app might have ten million end users, for instance banking customers, who can log in, ask questions, and perform tasks. Yet the database serving the application will be accessed by only a very small number of service accounts, often just one or two, each of which produces a firehose of queries against the database. The app shuttles the query results to end users, but the database itself never sees those end users. From the limited perspective of the database server, it simply looks like the app itself is making endless requests.

This is an efficient way to build an app, but it creates problems for protecting data because current security measures usually reside at the network level and at the database server, but not in between. That space in between—that gap—is precisely where end users interact with the app, for better and worse.

How the Gap Creates Challenges For Security and Compliance

Security teams must try to straddle that gap. Yet the nature of the problem means that their efforts are inherently limited precisely because existing methods for maintaining data security do not give them adequate context for users’ data access that occurs within the app. When security personnel look at access from the database server’s perspective, they cannot know which end user is accessing (or attempting to access) which data. At the other end of the gap, they ensure that only properly credentialed users log in, but usually cannot see what each user does within the application after that. This situation typically makes it difficult for security teams to formulate specific, granular policies that enforce compliance rules and keep data well protected.

When application owners and development teams tackle this problem, they should do so informed by the expertise of the functions dedicated to data protection. The code in an app should reflect best practices laid out by compliance specialists, and the efforts of app owners and developers should harmonize with the cybersecurity measures undertaken by security teams.

Ultimately, though, it is application owners, and the developers supporting them, who possess the context needed to close the gap outlined here. The best place to close that gap is at the source of the request within the application, where both the user and the reason for the request are known. This is the perspective from which to make the most informed decision about the appropriateness of the size and scope of a given query.

Code-Level Security Is the Way Forward

Because the gap just described is at the code level, it can be remediated only by data protection that exists at the code level. Any application-level solution to the problem requires at least three elements:

  • It must embed logic at the application level that is capable of understanding what is happening with data for a given action, from the end user through to the database.
  • It must be able to throttle usage that falls outside of prescribed limits; this must be done per role and per user, not merely using broad policies.
  • It must include the logic necessary to perform remediation when a problem happens.

Code-level security will only grow in importance as organisations shift more of their computing tasks to virtualized environments. It is the only way to ensure true data protection across the crucial gap in enterprise applications, regardless of where or how they are deployed.

To learn more about the challenges of data protection in enterprise applications and the impact of code-level security, please 

  1. Join the author for the Data Protection World Forum webinar, “Data Protection Is Everyone’s Job, so It’s No One’s Job.” 
  2. Download his Data Protection World Forum white paper, “Data Protection Is Everyone’s Job, so It’s No One’s Job.” 

Join our free-to-attend digital event, Last Thursday in Privacy, addressing data protection, privacy and security challenges including working from home, COVID-19, global regulations and more. Visit https://digital.privsec.info/.

We have been awarded the number 1 GDPR Blog in 2019 by Feedspot.