Top 10 Critical Findings of 2014 – Thick Applications

The final installment of the thick client series covers memory analysis: dumping a process from Task Manager, extracting strings, and why sensitive data should use mutable types that can be wiped.

Thick client series part five covers API monitoring and invocation: API Monitor logs over 500,000 calls during login, and .NET SmokeTest lets testers load assemblies and run individual methods.

NetSPI shows why .NET SecureString still leaks passwords in memory via NetworkCredential, and demonstrates safer login handling using pinned mutable byte arrays instead of immutable strings.

For the past five years it seems like almost everything in information security has focused on application security and, for the NetSPI consulting practices, our application security business (app pen testing, code review, etc.) has significantly increased.

Five steps for an effective secure code review program: build security culture with developers, rotate reviewers, standardize processes and tooling, and catch vulnerabilities before deployment.

ServiceTitan's Cassio Goldschmidt explains how software security frameworks evolved, and why application type, compliance rules, platform, and programming language shape each company's approach.