Applications are the lifeblood of our enterprises. Not many organizations can survive in a pencil and paper world. They are all dependent on IT with applications doing the heavy lifting of arranging, tracking, processing, communicating, and calculating daily business. But applications are no longer singular programs running on one computer, they are huge collections of interconnected services, processes, and data stores. Because applications are so complex and spread out, they can have many fissures and cracks that attackers can abuse. What is worrying is that sometimes our most critical applications are the most complex and consequently the most vulnerable.

What Are Critical Apps?

Critical applications are often so baked into the day-to-day tempo of an organization that users often forget their importance—right up until the moment they go down. Indeed, the first key definition of a critical application is how much an enterprise is reliant on it. By their nature, critical apps have enormous data stores, multifaceted processing engines, and are deeply integrated into other dependent application services. Critical apps also tend to sprawl globally, touching all locations within an organization’s reach. Here are specific types of these critical applications:

Financial Apps

Financial applications are the backbones of many organizations, yet they are often focused on the unique financial requirements of an organization. Consider the myriad of needs for banks that process loans. They need software that can deal with mortgage loans, car loans, revolving credit loans, small business loans, and leasing. These all follow different processes with different user bases at different cadences. It’s no wonder that banks have thousands of applications, all critical to revenue and business operations. Accounting applications are also often intricate and tailored to the particular industry of the organization.

Nearly all financial applications are subject to regulation, though their audits can be highly varied depending on their importance and sector of business. Most importantly, financial applications hold, process, and move critical financial data, which needs to remain confidential and unscathed from tampering. Because financial apps touch so many parts of a business, they often touch a wide range of locations, both internal and external. Often you will see Internet commerce systems with direct ties to financial systems to process and record customer payments. All of these are potential ingress points for attackers.

Medical Apps

Despite their appearance, hospitals are rarely singular entitles. Most of the time they are assemblages of independent, smaller clinics, doctor’s offices, diagnostic facilities, and service organizations. Their applications exist in the same manner: deeply vertical and highly variable, yet all woven together into a common shared system. This means lots of applications with different levels of security and reliability all sitting side-by-side exchanging essential confidential medical data. Some of these systems are so old, that it’s not surprising for an old Windows XP box to be connected to a drug dispenser machine. Some systems are so specialized that you may have software developed by a singular researcher, who maintains the program as a side project (if ever)¹. This is also an environment where patient safety trumps all other requirements, sometimes even security. So, you can see things like the network protocols that embed patient identification into the network packet itself to ensure medical information is never mixed up.² This is great for reliability and patient care but not so great for maintaining confidentiality on a shared network.

Email systems are also often the gateway to authentication with password resets landing in people inboxes. An analysis of the California Attorney General breach notifications for 2017 showed that 5% of reported significant data breaches were directly attributed to credential exposure via email compromise. Email messages often stand in as the primary identity on the Internet. When you send an email, people naturally assume it’s you that’s speaking. So a compromised email account can be leverage point for a variety of insidious scams, targeting both your customers and internal employees.³

Legacy systems are the most embedded yet the most difficult for IT to manage. Their function could fit into any of the previous categories, although a majority of them are specialized applications, often heavily customized by the organization. Think of airline reservation systems,⁴ customer management software,⁵ and one-off unique software.⁶ Legacy systems exact an excessive burden in their high operating cost and incompatibility with modern systems and security tools. The most difficult and insecure of these systems have existed in a long period of stasis, rarely updated due to their being written in archaic programming languages like COBOL.⁷ Legacy systems often have limited network facilities and when they do, they often run an excess of exploitable services like Telnet, FTP, Chargen, and Finger. Often these vulnerable services aren’t easily disabled and may even factor into dependent functions within the legacy application.

Many older and specialized applications do not have sophisticated or robust authentication systems. This can lead to mismatches between these critical apps and your security requirements regarding password length, rotation, and complexity. This is even more true for legacy systems since some older systems have a maximum password length of 8 characters.⁸

With all these network connections to critical apps running around your enterprise network, it’s a good idea to secure the transmission, as well. A malicious insider or an attacker that’s already breached your network is a viable potential threat, so any internal traffic carrying confidential information should be protected. If the critical app doesn’t support a secure transport protocol, then a TLS or VPN gateway can be used. Like the authentication gateway, these sit in front of the critical app and encapsulate all traffic passing through into an encrypted tunnel. These should also be used for all external links from the application, even to trusted third parties.

Defend Those Critical Apps

In time, the operational cost of managing and securing older but critical apps will probably mean they will be replaced, likely by software-as-a-service or cloud offerings. However, for a lot of organizations, these systems still exist as stark risks to operations and security requirements. Since these critical apps are well, critical, security teams should work to defend them against attacks that could cripple them, tamper with them, or take them down.