So much of the digital world that we live in today is driven by apps, whether mobile or web-based. Because of this, apps are becoming a prime target for Cyberattacks. For this reason, it’s essential to consistently apply the latest patches and upgrades to every device you use.
While these steps are important, the first line of defense should be to ensure that the source code used to create the app is as secure as possible. Meaning at each level, the code needs to be tested for any weaknesses or vulnerabilities, and once discovered, they must be remediated immediately. Much of this responsibility falls on the shoulders of the app’s software developer. This article looks at some of the top mistakes they make and how that leads to compiled corrupt sources.
The Top Mistakes
1. Not fully understanding the requirements
Ultimately, an app is created to satisfy the client's needs or to meet the needs of employees in your company. In either case, the software developer must understand what the client is looking for—a process often tasked to the Project Manager. After meeting with the client, they then convey the requirements to the development team. This process can lead to a gap in a full understanding of what is needed. A better approach would be to have a designated development team member join in on these initial requirements meetings so that everybody is on the same page and the development team has a thorough understanding of the scope.
2. Lack of communication
Very often, in the course of the project creation, software developers tend to work in their own worlds, independent of everybody else with a critical stake in this. This is known as a “siloed” approach and results in a lack of communication taking place between the development and the Project Manager. A lot of assumptions are made because of this, which creates security risks. The only formal communication usually occurs when the lead software developer communicates to the Project Manager that a key milestone has been completed. Many companies today are starting to see how this can lead to an app that does not meet the client's needs but is also insecure. One way that the CISOs are trying to eliminate this problem is by adopting a framework known as “DevSecOps.” This is a combination of the IT Security Team and the Operations Team working hand in hand with the software developers to ensure that clear lines of communication are established so that no mistakes and misunderstandings are made.
3. Using too much technojargon
During the development of the app, two sets of documentation will have to be created – the administrative guide (primarily for installing the app) and the end user guide (giving step-by-step directions to the client on how they should go about using their new tool). Creation of this tool often falls into the hands of the Development team, as they know best what needs to be included. But software developers are often best at compiling code—not creating documentation. Because of this, complaints arise that the documents are too difficult to understand and follow. To alleviate this problem, it is usually best to have a technical writer involved in the process from the beginning who understands both sides of the fence—the technical and the non-technical.
4. Making assumptions
If a software developer does not have all the information they need, they might make assumptions and claim them as facts to keep the process moving to meet the deadlines set forth by the client. Making a few assumptions probably will not have a detrimental impact on the project's overall scope, but too many of them will. This is one of the side effects of taking a siloed approach. A Business Analyst should also be included on the team to prevent this from happening. It is also vital that this person sits through the requirements meetings at the beginning of the project so they understand the project requirements completely. That way, if a software developer needs help clarifying an assumption, the Business Analyst can step in and determine the amount of risk this will have. Or they can even go back to the client to be sure that what is being assumed is also 100% fact.
5. Not thoroughly testing
In today’s world, there are many wireless devices that contain different kinds of browsers (such as Edge, Chrome, Safari, Opera, Firefox, etc.). These browsers even come on desktop computers. With software developers, there tends to be a line of thinking that what works in one device will work in all the others. In other words, they tend to take a “one size fits all approach.” But given how much end-user technology there is out there, it’s too dangerous to take this bold of an assumption. Therefore, the app needs to be tested to confirm that it works in all browsers and all major devices (a bulk of them are Android or iOS based). This methodology is also technically known as taking a “UI/UX” approach. These are both acronyms for "User Interaction/User Experience.”
Overall, this article has examined some of the top software development mistakes that are made at a macro level. In a future piece, we will look at mistakes made at the technical level in the source code itself. To learn more, please contact us at sales@sprucetech.com to learn more.