Application Security Problems Stem From Customization

"Custom code does not undergo the same QA testing as commercial code does," Mogull said.

"All major applications, be they an application server or off-the-shelf software is implemented mostly through custom code and this is one of the biggest issues facing major application security. But what is even worse about this is any vulnerability you have in your system is yours and no one else will find it but you.

"The advantage of off-the-shelf programs is that vulnerabilities are managed by vendors through patch update, but typically the security models that we do see featured in some applications are limited compared to the amount of customization done on applications to get them running."