“Before any lines of code are written, the software development and application security teams should work together to establish a risk-based policy that features a shared vision of high-quality, secure software,” Miller wrote.
He noted that agencies should embrace dynamic, static and interactive app security testing and application programming interface security testing to automate security testing of their mobile apps.
“Running automated assessments on every code commit and every push or pull request will encourage adoption and enable further continuous testing,” he added.
Miller said agencies could also partner with companies that offer automated and manual app testing and discussed the potential benefits of continuous app monitoring to agencies.
Amid the increasing software supply chain attacks, Miller also called on agencies to require a software bill of materials for mobile apps they develop and those being used by employees on their agency-issued devices.
“Furthermore, a dynamic SBOM can show the geolocations of API and network connections, which can help agencies know when an application connects or shares data with foreign countries,” he added.
The Defense Information Systems Agency’s Defense Information Technology Contracting Organization has awarded Modern Technology Solutions Inc. a potential $416 million contract,…
L3Harris Technologies has secured a potential $200 million follow-on contract from Lockheed Martin to supply insensitive munition propulsion units for…
