“Before any lines of code are written, the software development and application security teams should work together to establish a risk-based policy that features a shared vision of high-quality, secure software,” Miller wrote.
He noted that agencies should embrace dynamic, static and interactive app security testing and application programming interface security testing to automate security testing of their mobile apps.
“Running automated assessments on every code commit and every push or pull request will encourage adoption and enable further continuous testing,” he added.
Miller said agencies could also partner with companies that offer automated and manual app testing and discussed the potential benefits of continuous app monitoring to agencies.
Amid the increasing software supply chain attacks, Miller also called on agencies to require a software bill of materials for mobile apps they develop and those being used by employees on their agency-issued devices.
“Furthermore, a dynamic SBOM can show the geolocations of API and network connections, which can help agencies know when an application connects or shares data with foreign countries,” he added.
Government IT services contractor Aretum has promoted Amy French, most recently chief accounting officer, to chief financial officer. Vienna, Virginia-based…
Shield AI has agreed to acquire simulation software company Aechelon Technology as part of efforts to expand its technological capabilities. The San Diego-based…
SentinelOne, a company specializing in artificial intelligence security, has promoted Barry Padgett to president and chief operating officer. The appointment takes effect…
Anduril Industries and Palantir Technologies are helping develop software for the potential $185 billion Golden Dome next-generation missile defense shield,…
