This aspect should be covered external to the device by intrusion detection systems (IDS), which monitor a network for unauthorized activity; intrusion prevention systems, which follow traffic to prevent network vulnerability exploits; firewalls; and antivirus scanners.
This includes simple things such as password protection, policy management, and patching systems to keep up-to-date with new security protocols. Two-factor authentication should be employed whenever practical. For example, withdrawing funds from an ATM requires both a debit card and a PIN; having one or the other is not enough.
Security standards should be in place during the development process. Vulnerabilities should be found during the development stage, not after the application is completed. Third-party code that is embedded into the application—especially open-source libraries—should be scrutinized for vulnerabilities. Any software that is purchased to help produce the application—indeed, any that is used on terminals upon which the application is developed, including things unrelated to it—should also be held to high security standards. Even things like third-party browser toolbars should be monitored closely to make sure they do not represent a security risk. Finally, the application should be protected by a firewall.
Shared Threat Intelligence
It’s extremely important for developers to share information concerning cybersecurity threats. Not only could learning something new protect your own application, but any information you provide may also help another developer do the same. The Information Technology Information Sharing and Analysis Center, or IT-ISAC, is an invaluable resource for developers to help prevent cyberattacks, as is the Common Vulnerability Enumeration (CVE).
Users themselves will often unknowingly create vulnerabilities within an application’s infrastructure. For example, users often will only keep a few simple passwords to access multiple applications and accounts; their email password is usually the same as the one they’ll use when they shop on Amazon, or when they access their banking information online. A vulnerability in one account, even if it’s entirely unrelated to your application, can create a security risk for others because of this. Your users need to be educated as best as possible to maintain a secure environment for themselves and other users.