“Before any lines of code are written, the software development and application security teams should work together to establish a risk-based policy that features a shared vision of high-quality, secure software,” Miller wrote.
He noted that agencies should embrace dynamic, static and interactive app security testing and application programming interface security testing to automate security testing of their mobile apps.
“Running automated assessments on every code commit and every push or pull request will encourage adoption and enable further continuous testing,” he added.
Miller said agencies could also partner with companies that offer automated and manual app testing and discussed the potential benefits of continuous app monitoring to agencies.
Amid the increasing software supply chain attacks, Miller also called on agencies to require a software bill of materials for mobile apps they develop and those being used by employees on their agency-issued devices.
“Furthermore, a dynamic SBOM can show the geolocations of API and network connections, which can help agencies know when an application connects or shares data with foreign countries,” he added.
Client Solution Architects has appointed Ellen Barletto as chief growth officer, expanding her leadership responsibilities after nearly two decades with…
Brian Meyer, federal field chief technology officer at Axonius Federal, said cybersecurity asset management could help government agencies make dozens…
“Technology transformation company Red River has acquired Invictus International Consulting to expand its cybersecurity and enterprise modernization capabilities to support…
Synergy ECP, a software engineering, cybersecurity and systems engineering services provider, has acquired NetServices, a company offering secure, mission-focused technology services. The…
