The Comptroller of the Currency Administrator of National Banks (OCC) issued a bulletin to all national banks, and their technology service providers that application security is an important component of their information security program.  The OCC Bulletin 2008-16 was issued in May of this year.  Although it's been over 5 months since the bulletin was issued, there hasn't been a mad rush from the banks to secure their Web applications.  But, in all fairness, they have had other things on their minds.

I wanted to recap the bulletin so we don't lose sight of the importance of application security.  The bulletin made a good effort to raise awareness about securing Web applications.  It highlights reasons why Web-based applications are being targeted including: 

• The numerous vulnerabilities in Web applications,
• The openness of the Web, and
• The fact that network devices like firewalls and IDSs are not effective against Web application layer attacks.

The bulletin asks the banks to ensure that all applications are developed and maintained in a manner that appropriately addresses risks to the confidentiality, availability, and integrity of data.  Banks should look at various factors such as accessibility of the application via the Internet, whether the application is built in-house or purchased, secure practices in the application development process, and others.

I was pleased to see an explanation around purchased or commercial applications.  The bulletin correctly points out that even though banks have to rely on the software vendors to provide secure applications, bank management remains responsible to make sure that the customer and employee information is secure.

Although this is a nicely written bulletin with some real good advice, we need a much stronger regulation making application security mandatory.  We have seen a lot more financial institutions in the last few months using our solution to automate their security assessment and actively secure their Web applications.  However, we know that there are hundreds of other companies who haven't even started thinking of application security. Given that most attacks are occurring through the Web sites, and customer information is being stolen every day, it's mind boggling to see that companies and regulators are not taking this issue seriously enough. What would it take to get companies to get off the dime and do something?  

If we learned anything from the recent  credit market collapse that prompted painful actions after the damage was done is that it's much better to be proactive than wait for a catastrophe to happen.  I hope companies and regulators don't wait for a catastrophe when it comes to protecting our Web infrastructure because that could be really devastating.

by
Mandeep Khera, Chief Marketing Officer
Mandeep@cenzic.com