Lately I have been up to my eyeballs in Information Security. I am sure most people "KNOW" that they need to make their application as secure as possible without compromising the functionality. For all those writing applications that handle sensitive information you may want to keep the "CIA" in mind.
CIA stands for Confidentiality, Integrity, Availability:
- Confidentiality concerns the protection of sensitive information from unauthorized disclosure
- Integrity relates to the accuracy and completeness of information as well as to its validity in accordance with business values and expectations.
- Availability relates to information being available when required by the business process now and in the future. It also concerns the safeguarding of necessary resources and associated capabilities.
Below is a "Security Triangle" that is commonly used by security professionals when they evaluate applications before it's allow to be used in their enterprise. The black dot represents where your application should be when its comes to being a secure app. You may have found yourself coding towards "Ease of Use" and "Functionalities", rather than think much about the "Security". Which would put your applications "black dot" lower on the triangle away from security. And if you do get more secure, your app suffers and ultimately not appealing to most.
So how do you meet specific security requirements of you customers when all they want is a "pretty" app? First, educate yourselves, then educate them. The more you know about security procedures, the easier it will be to create an app that's secure and explain why it's necessary to do so.
