“Before any lines of code are written, the software development and application security teams should work together to establish a risk-based policy that features a shared vision of high-quality, secure software,” Miller wrote.
He noted that agencies should embrace dynamic, static and interactive app security testing and application programming interface security testing to automate security testing of their mobile apps.
“Running automated assessments on every code commit and every push or pull request will encourage adoption and enable further continuous testing,” he added.
Miller said agencies could also partner with companies that offer automated and manual app testing and discussed the potential benefits of continuous app monitoring to agencies.
Amid the increasing software supply chain attacks, Miller also called on agencies to require a software bill of materials for mobile apps they develop and those being used by employees on their agency-issued devices.
“Furthermore, a dynamic SBOM can show the geolocations of API and network connections, which can help agencies know when an application connects or shares data with foreign countries,” he added.
Textron Aviation Defense has been awarded a five-year, $150 million contract to provide sustaining engineering and program management, or SEPM, services…
Merlin, an aerospace and defense technology company, has appointed former PsiQuantum executive Mark Brunner as chief revenue officer. What Will Mark Brunner Oversee?…
Fortreum has acquired Kovr.AI, an AI-native cybersecurity compliance platform, to combine automated compliance capabilities with independent assessment services for federal…
