Our approach to secure enterprise application development

Enterprises face an array of digital threats that can compromise sensitive data, disrupt operations, and tarnish reputations. How do you ensure that the digital solutions powering your business are not only robust and efficient but also armored against the sophisticated cyber threats of our time? In this article, we discuss enterprise application security — from the definition of enterprise apps to the security challenges they face and the best practices for safeguarding them. We also share our approach to application security and related case studies.

What is an enterprise app?

An enterprise application is a large-scale software system designed to operate within a corporate environment. Unlike applications aimed at individual consumers, enterprise applications are built to meet the complex, numerous needs of organizations. They support thousands of users simultaneously, simplifying and improving business operations and processes. Supply chain management, HR, ERP, and CRM systems are examples of enterprise apps.

These applications need to integrate and operate cohesively within the existing technological infrastructure of an organization. This means that whether a company is managing its customer relationships, overseeing its supply chain, or streamlining its internal communications, an enterprise application should handle these tasks across various departments, locations, and possibly even globally.

Why do companies develop enterprise applications?

Sometimes enterprises request application development to get a product that solves their specific business needs, and sometimes, startups create enterprise-level software to provide services to other companies.

Slack is an example of such a startup that became an enterprise application that many big organizations use. Slack's journey into application development is one of adaptation and unexpected success. It all began with a small company called Tiny Speck, which initially focused on developing a multiplayer online game called Glitch. As the team collaborated on Glitch, they needed a way to communicate effectively. The existing tools didn't meet their needs, so they built their own. This internal communication tool allowed seamless messaging and file sharing among the team members, proving to be more valuable than the game itself. Born out of necessity, Slack transformed a muddled gaming venture into a widely used, successful productivity tool. In only eight months, Slack attained a billion-dollar value, achieving this impressive feat without investing in ads or marketing.

SAP ERP is an example of a popular enterprise resource planning software developed by SAP SE. Their vision was to create software that allowed businesses to process data when and where they needed it. The development of SAP's ERP began with the launch of SAP R/1 — it was a one-tier architecture where presentation, application processing, and data management were on the same server. Later, they launched SAP R/2, which ran on mainframe computers and was a big step in introducing a more robust and comprehensive suite of applications. As technology evolved and the client-server model became popular, SAP moved on to the development of SAP R/3 which was a massive hit and became standard ERP software for large multinational companies. It was highly customizable and allowed for integration with other systems, which made it an attractive solution for complex organizations.

Speaking about secure enterprise applications developed for a specific company, Tesla is an example of a company that uses a custom enterprise solution. Tesla experimented with off-the-shelf enterprise software to manage their ERP and e-commerce processes. Yet, they soon recognized that this solution was not suitable for their specific needs. Tesla was in search of a flexible system that could be customized extensively to align with their unique requirements. Elon Musk understood this necessity from the beginning and chose to allocate resources to assemble a team that would craft a tailor-made solution specifically for Tesla. Within a mere four months, Tesla's IT department developed an ERP system known as Warp. Today, Warp is a vital component of Tesla's operational framework and their online sales infrastructure, and a part of their competitive advantage.

Although most enterprises have unique operations based on their products, it doesn't mean that every company needs an expensive system of solutions tailored to their business and an IT department to support this system. At Ronas IT, we choose technical solutions based not only on your business needs but also on your budget expectations, including the cost of support. Whether you're planning to build a custom enterprise application specifically for your company or to create a versatile app that suits many businesses and sells it, we have the expertise to do it for you.

Why is enterprise application security important?

Security matters a lot when it comes to enterprise applications. Think of these apps as a bank that holds your company's most precious things: data, plans, and client info. Just like a bank needs strong vaults and locks, your apps need tough protection against possible theft and damage.

Besides, laws often tell companies to protect customer data. If you don't, it could cost you a lot in fines, or worse, your customers might lose trust and walk away. Reputation is a thing hard to fix once it's broken, which is especially critical for enterprises. If your app gets hit by a security breach, the news can spread fast. People remember companies that let their data get stolen.

According to Edgescan's 2021 report, the size of an organization significantly influences the severity of its security vulnerabilities. Firms having up to 100 workers encountered the smallest share of vulnerabilities considered medium, high, or critical, with only five percent falling into these categories. Conversely, the largest enterprises, boasting 10,000 or more employees, faced the highest frequency of medium and critical application security risks. Meanwhile, entities of a medium scale, those numbering between 101 and 1,000 staff, were most likely to experience vulnerabilities deemed high risk.

Common enterprise application security vulnerabilities and security threats

Enterprise applications, due to their complexity and the critical data they handle, are attractive targets for cyber attackers. These applications often integrate with numerous other systems within an organization, increasing the potential attack surface.

The National Vulnerability Database (NVD) and the Common Vulnerabilities and Exposures (CVE) system have cataloged more than 176,000 application security vulnerabilities to date, making it impractical to mention each one in this article. However, we made a list of the most common ones:

1. SQL injections:

It's a type of cyber attack that targets the databases of web applications and services. It involves inserting or &dquot;injecting&dquot; malicious SQL code into an input field or data query within an application that uses an SQL database. This manipulation is aimed at tricking the application into executing unintended commands or accessing unauthorized data.

The consequences of a successful SQL injection attack can be severe and include unauthorized viewing of user lists, the deletion of tables, the obtaining of administrative rights to the database, and in some cases, command execution on the database server. This not only poses a risk to data confidentiality and integrity but also to the availability of data and services.

2. Cross-Site Scripting (XSS):

It's an application security vulnerability typically found in web applications. This type of attack enables attackers to inject malicious scripts into content that appears to be from a trusted website. When users interact with this malicious content, the injected script can execute in their browsers, leading to various potential security issues like hijacked user sessions, defaced websites, or redirected users to malicious sites.

3. Brute force attacks:

Brute force attacks are a trial-and-error method used by attackers to gain unauthorized access to accounts, systems, or network resources. In such attacks, attackers systematically check all possible passwords or passphrases until the correct one is found. Due to the simplicity of the approach, brute force attacks can be employed against virtually any type of encrypted data, login mechanism, or online service. These attacks are possible because of weak passwords, no multi-factor authentication, broken authentication systems, etc.

4. Phishing:

A deceptive practice where attackers use email, text messages, or social media to trick individuals into providing sensitive information, such as passwords or credit card numbers, by pretending to be a trustworthy entity.

5. Sensitive data exposure:

Poor protection of sensitive data such as financial information, personal data, and authentication credentials can lead to unauthorized access and data breaches. This might occur through weak encryption or when sensitive data is exposed in the URL or stored insecurely.

6. XML external entities (XXE):

XXE refers to a type of security vulnerability found in web applications that parse XML input. This flaw exploits features of XML parsers that allow external entities — blocks of data referenced by the XML document but defined outside of it — to be included and processed within the XML document. Attackers can exploit XXE vulnerabilities to launch various attacks, including accessing local files on the server, conducting internal port scanning, remote code execution, and denial-of-service (DoS) attacks.

7. Broken access control:

Applications not properly enforcing access controls can allow unauthorized users to access or modify data or functionalities. The lack of robust access control mechanisms can lead to unauthorized disclosure of information, data modification, or destruction.

8. Application security misconfiguration:

This broad vulnerability arises from insecure default configurations, incomplete or ad hoc configurations, open cloud storage, misconfigured HTTP headers, and verbose error messages containing sensitive information. These flaws give attackers unauthorized access to system data or functionalities.

9. Insecure deserialization:

Serialization is the process of converting an object into a format that can be easily stored or transmitted (such as XML, JSON, or binary format). Deserialization, conversely, is the process of converting the serialized format back into a usable object within an application.

When an application deserializes data without sufficiently verifying the validity or integrity of the data, it can be led to execute unintended or malicious code. This can happen because attackers can modify serialized objects to include unexpected data or code that gets executed during or after deserialization. It can let attackers run malicious code on the server or application, manipulate the internal state or behavior of the application, and conduct DoS attacks.

10. Using components with known vulnerabilities:

Components, such as libraries, frameworks, and other software modules, almost always run with full privileges. If a vulnerable component is exploited, such an attack can facilitate serious data loss or server takeover.

Addressing these vulnerabilities requires a comprehensive strategy for enterprise application security, including regular security testing and audits, adoption of secure coding practices, timely patch management, and security awareness training among developers and administrators. In the next section, we'll discuss it in more detail.

How to find out your app's vulnerabilities?

There's a standard measurement system for organizations that need accurate and consistent vulnerability severity scores, called CVSS, or Common Vulnerability Scoring System. It's a framework for rating the severity of application security vulnerabilities. The score is calculated based on several metrics that reflect the different aspects of a vulnerability's potential impact. These include metrics like the complexity of the exploit, the need for user interaction, the scope of the affected system, and the confidentiality, integrity, and availability impact.

CVSS scores are typically expressed on a scale from 0 to 10, with 10 being the most severe. They help organizations prioritize their response to vulnerabilities based on their severity. For instance, an enterprise might decide to first address vulnerabilities with CVSS scores above 7, as they represent a more significant risk.

Another way to find and evaluate vulnerabilities is to request a security audit. A security audit is a comprehensive review of an organization's information technology infrastructure, policies, and operations to identify vulnerabilities, assess risks, and ensure compliance with industry standards and regulations. Its objective is to safeguard data from threats and ensure the integrity, confidentiality, and availability of information. Security audits are crucial for identifying weaknesses that could be exploited by attackers and for maintaining the trust of customers and partners.

Effective enterprise application security audits are typically performed by independent auditors or third-party firms specializing in cyber security to ensure an objective and thorough examination. Regular security testing and audits are essential for any organization to maintain a strong security posture and comply with regulatory requirements.

How to achieve the needed level of enterprise application security?

Enterprise applications are more complex than regular ones because they have many parts and connected systems that need protection. Securing enterprise software means protecting all of a company's software, not just one app — this includes the systems and tools that they run on. This makes setting up strong application security harder. It also means that businesses must be very careful about following security rules, deciding which security problems to fix first, and making sure their whole company's software is protected.

There are several steps you can take to improve the cyber security of your enterprise apps:

1. Authentication and authorization:

Improving authentication and authorization is crucial for enterprise application security as it strengthens the defense against unauthorized access to systems and data.

• Implement strong, multi-factor authentication mechanisms.
• Use Role-Based Access Control (RBAC) to ensure users have the minimum necessary permissions.
• Regularly review permissions and access rights for changes in roles.
• Set up account lockout policies to temporarily disable accounts after a certain number of failed login attempts.
• Use advanced analytics and machine learning to detect abnormal behavior that may indicate compromised credentials.

2. Secure coding practices:

Secure coding practices are a set of guidelines that developers follow to prevent vulnerabilities in software and protect it from malicious attacks. Such practices ensure that the code is not only functional but also secure from the outset, reducing the risk of security breaches and data leaks.

• Follow secure coding standards to write robust, exploit-resistant code.
• Conduct static and dynamic code analysis to find and fix security issues.
• Keep frameworks and libraries up to date to patch known vulnerabilities.
• Automate build and deployment processes to minimize human error.

3. Data encryption:

Data encryption is a security measure that involves transforming readable data into an encoded format. The resulting ciphertext appears as seemingly random data, making it unintelligible to unauthorized parties.

• Employ TLS/SSL to encrypt data in transit.
• Use encryption for data at rest, especially for sensitive information.
• Manage encryption keys securely: use longer keys and ensure they're rotated, expired, and revoked according to security policies.
• Apply end-to-end encryption.

4. Secure APIs:

Securing APIs is crucial since they often provide a gateway to sensitive systems and data.

• Protect APIs using tokens, API keys, or OAuth to control access.
• Ensure that backend APIs validate input and output data to prevent common attacks such as SQL injection and XSS.
• Regularly update all your software dependencies to protect against known vulnerabilities.

5. Security audits and penetration testing:

• Periodically perform security testing and audits to assess vulnerability to threats.
• Employ penetration testing to simulate attacks and identify weaknesses.

6. Compliance with standards and regulations:

• Adhere to industry security standards like ISO/IEC 27001.
• Comply with any relevant regulations, such as GDPR for privacy, or PCI-DSS for payment processing.

7. User training:

• Train employees on security best practices, such as recognizing phishing attacks and securing their devices.
• Educate users on the importance of maintaining the security of their accounts and data.

8. Device and endpoint security:

You need to protect devices that access your organization's network, including desktops, laptops, smartphones, tablets, servers, IoT devices, and other network endpoints.

• Implement solutions like Mobile Device Management (MDM) or Mobile Application Management (MAM) for devices accessing enterprise apps.
• Ensure that devices have updated operating systems and antivirus software.
• Secure IoT devices by implementing strict access controls, segmenting networks, and continuously monitoring for unusual behavior.

9. Secure deployment and maintenance:

• All enterprise software deployment environments (development, testing, staging, and production) should be configured securely. This includes setting correct permissions, using secure protocols, and disabling unnecessary services.
• Regularly update the app to address any new security concerns.
• Using automated deployment tools can help remove human error from the deployment process and ensure that each deployment is consistent and repeatable.

10. Network security:

Securing a network involves implementing a variety of practices, policies, devices, and software solutions designed to protect the integrity, confidentiality, and accessibility of computer networks and data.

• Protect your network with firewalls, intrusion detection/prevention systems (IDS/IPS), and secure VPN access for remote users.
• Utilize strong encryption (WPA3 or at least WPA2), disable WPS (Wi-Fi Protected Setup), hide network SSIDs, and always change default passwords.
• Segment the network into subnetworks, allowing sensitive information and critical operations to be isolated and protected separately to limit the spread of an attack.

11. AI integration

The integration of artificial intelligence can bolster app security for enterprises by bringing in automation, predictive capabilities, and advanced threat detection techniques.

• Artificial intelligence can spot anomalies or deviations that might suggest a security threat, such as a data breach or an ongoing cyber attack, with greater accuracy than traditional systems.
• By analyzing past security incidents and current data trends, AI can predict potential future attacks or identify vulnerabilities before they are exploited.
• AI can automatically respond to detected threats in real time by taking pre-defined actions such as isolating affected systems, revoking access, or implementing additional authentication steps, thus limiting the damage caused by an attack.

Our approach to security on examples of real cases

At Ronas IT, we provide secure enterprise application development services, as well as security audit services. In this section, we share our approach to application security with examples of our projects. These projects are under NDA, so we can't share the clients' or companies' names as well as the app screens. However, we can explain how we exactly solved the clients' problems and which solutions we provided.

Security audit case

Our client is a European financial company which suffered a data breach. They contacted us for a security audit of their apps. We started with finding out the details about the breach, how their infrastructure works, and which systems are involved in the business processes, as well as gathering the client's security requirements and expectations. Together, we decided to perform an audit of the most significant apps that had access to sensitive data — ERP, CRM, a Business Intelligence system, and an accounting system.

The scope of work included a technical assessment to identify the vulnerabilities in the apps. We reviewed their systems and configurations of apps, performed penetration testing, and scanned the apps for vulnerabilities. We checked whether the apps met the requirements of relevant compliance standards: GDPR and PCI-DSS. We also interviewed our client to figure out whether they have security instructions or policies for the employees.

In the result, we figured out that some of the apps lacked protection against different types of attacks like injection, DDoS, and XXS. Another major issue was that employees had unnecessary access to parts of applications that they didn't use in their work. We created a detailed report with all the findings and suggested our recommendations. Protecting the apps against cyber attacks was a top priority and we recommended a set of tools and practices to increase protection. We also recommended using such mechanisms as the privilege approach and fine-grained access to limit access to sensitive information and minimize risks.

Once our suggestions were applied in practice, we agreed on a follow-up review. During the review, we made sure that the found vulnerabilities were properly mitigated.

Secure enterprise application development case

A large marketing agency approached us to develop a custom project management application for their enterprise system. They found us on Dribbble and were inspired by this design concept:

Before requesting us, they used an off-the-shelf solution but after several years it stopped meeting their specific needs. One of these needs was that they needed the app to integrate with their system of apps like HR, analytics, design software, etc. They also needed to highly secure the app to avoid data leakage since they have a lot of marketing projects with sensitive information about their clients. During the initial call, we gathered all requirements and the client's business needs, as well as analyzed their current solutions to ensure a smooth integration with the new app.

We designed and developed a web application using Laravel and React, and these were the main tools we used for the application security:

• auth0 for secure authentication;
• AWS S3 as a secure cloud storage;
• Cloudflare as a tool for higher security since it provides DDoS protection, a web application firewall that helps against SQL injections, DNS security, SSL/TLS encryption, and more;
• To make sure the app meets the needed security standards like SOC2, we used Vanta as a compliance automation tool which also saved us time on development.

In the process of application development, we never accessed the client's data stored in any apps — it's important for privacy.

We managed to develop the first version of the app in 4 months and successfully integrated it with the agency's systems. After we finished the project, the client stayed with us for support and maintenance — we continued to add new features and monitor the app using the DevOps approach to effectively address any possible issues.

How Ronas IT can help you with secure enterprise application development

If you wish to develop a secure enterprise application, we can offer you to build a secure application based on proven enterprise-ready solutions that can be certified with SOC 2 — this certification ensures that the service follows strict information security policies and procedures. Incorporating ready-made security solutions allows us to cut on application development costs and rapidly accelerate the process while maintaining a proper level of application security.

Apart from SOC2, we pay close attention to regulatory compliances like GDPR for EU organizations, HIPAA for US healthcare organizations, PCI DSS for financial institutions, ISO for managing sensitive information, etc. Our development team covers more than 95% of key modules by tests — it's crucial for upholding software quality and reliability.

To integrate the new service with your current enterprise systems, we analyze your business processes and take into account your current decisions at the stage of building the architecture. If you don't have any specific technical decisions, we prefer to use microservice architecture since it allows us to make changes point-by-point when your business needs it.