Application Security, Research Paper Example

Security Controls

For a number of years controls have been used in IT for security purposes. In the past, the focus of the controls was only on the internal systems. But, in early 2000s there were numerous frauds incurred by large corporations such as Enron and WorldCom (Umar, 2003). As a result the use of external controls has increased. Application controls can protect the application from unauthenticated and unauthorized users alone. Whereas the auditing, which is an external control must be implemented to protect the application from the external attacks. Thus the application security should emphasize on the combination of application controls and the external controls to protect the assets of the organization.

Resource Custodian

An Information Resource Custodian is a person or a department responsible for managing the access to the information resource and resource controls. Resource custodians are generally referred to as system administrators or IT service providers. By default, the users are the custodians of their devices and are responsible for ensuring that the device comply with the policy requirements. For example, The University is the resource custodian of the data concerning its staff, students and faculty, as well as the university itself (Umar, 2003). Only authorized users may access and use the confidential information.

I²SF-GASSP Approach

In mid-1992 Formation of the International Information Security Foundation (I²SF) – Sponsored Generally Accepted System Security Principles Committee (GASSPC) began (Poore, n.d.). GASSP approach provides legal and authoritative reference for information security practices, principles and opinions. Good practices will increase the efficiency and effectiveness of the business, promote trade and improve productivity of the application. In future, due to the technological advances, the password technology will be replaced by the smart card technology there by increasing the application security (Poore, n.d.).

References

• Amjad Umar (2003). Information Security and Auditing in Digital Age: A Practical and Managerial Perspective. NGE Solutions, Inc.
• Ralph Spencer Poore (n.d.). Generally Accepted System Security Principles (GASSP). In Information Security Today. Retrieved February 25, 2013, from http://www.infosectoday.com/Articles/gassp.pdf