---
title: Who's responsible for web application security?
teaser: 'In short, we''re all responsible. And this is why.

  '
tags: security,new bamboo,web
author: Alexis Ternoy
published_on: 2015-02-12
---

_This post was originally published on the New Bamboo blog, before [New Bamboo
joined thoughtbot in London][new-bamboo-thoughtbot]._

---

You’ve probably seen the posters that say health and safety is everybody’s job.
Well, that’s how we feel about security too. There’s a lot of personal and
customer data stored in web applications, ranging from email addresses to credit
card details. If compromised, this data can be traded on the black market and
might end up being used for fraudulent transactions, spamming or to crack user
accounts on ecommerce sites. It’s a target, and protecting it is both our job,
and yours.

We’d like to see product owners and client organisations taking a keener
interest in security. It often appears that companies only take the security of
their applications seriously after they’ve been hacked. The clean-up costs can
be immense. One report estimates [the worst cyber security breaches cost large
companies an average of between £600,000 and £1.15 million][breach-costs],
excluding any costs arising from reputational damage. The average cost doubled
between 2013 and 2014, too. Settling a bill that big is bound to focus the mind,
but at this point the damage is already done. There are customers frantically
changing passwords and worrying about what else might have been compromised.
They’re unlikely to trust you again. If you’re going to ask people for data, you
have a responsibility to look after it and to be proactive in ensuring it is as
secure as possible.

So what can you do? The most important thing is to make security a priority
within your organisation, talk about it, and allocate budget for it. One
practical step you can take is to commission an independent company to do a
penetration test, where they attempt to infiltrate your web app. We work with
penetration testers, and we typically give them the entry points for the
application, tell them what it’s supposed to do, and give them some example data
and credentials so they can log in. They then try to break it, and break into
it, to see how the app responds to a targeted attack. We’re confident in the
security of our applications, but we still think clients should take the
initiative and thoroughly test them, and demonstrate security leadership to
their customers.

On our side, we invest in making sure we are using the latest tools and
guidelines. We recently gave the whole company a day’s training on web security,
delivered by former Bambino Najaf Ali, who now runs [his own
agency][happy-bear]. Allocating a day to this represents a significant
opportunity cost for us, but is something we consider to be an important
investment. During that day, we looked at different types of vulnerabilities
that can be exposed in typical web apps, many of which are automatically
protected against by the Ruby on Rails framework. Rails comes with excellent
security features out of the box, and we augment it with third-party libraries,
automated scanners and best practices to ensure the applications we build are as
secure as possible. This training enabled us, though, to understand the
different ways an application can be attacked and how applications have been
cracked in the past, so we are better prepared to understand and respond to any
new vulnerabilities that might be discovered in the future.

So next time somebody asks you who’s looking after the security of your app, be
bold: tell them you are, and they are, and we are. Security is everybody’s job.

[breach-costs]: https://www.gov.uk/government/news/cost-of-business-cyber-security-breaches-almost-double
[happy-bear]: http://www.happybearsoftware.com/
[new-bamboo-thoughtbot]: https://thoughtbot.com/blog/new-bamboo-joins-thoughtbot-in-london