TS 8535 Week 10 Assignment System and Application Security

Student Name

Capella University

TS-8535

Professor Name

Submission Date

System and Application Security

Technological security has become a much-needed pillar of systems and applications for organizational resilience, and the increasingly fast-paced digital transformation is the time. The growth of cloud computing, mobile platforms, the Internet of Things (IoT) ecosystems, and software-defined infrastructures offers unprecedented opportunities. Still, at the same time, the attack surface is rapidly being widened (Malik et al., 2024). 

Research into the security of systems and applications has intensified due to cyber threats that are increasing in frequency, scale, and sophistication, resulting in new models for defense, automated methods for identifying vulnerabilities, and enhanced supply chain security. Recently, scholars made active efforts towards bridging theoretical foundations with practical solutions and, at the same time, unraveled some of the unresolved gaps challenging industry adoption. The following paper presents a critical review of the strengths and weaknesses in the latest research in order to help shed light on the maturity of the field, the effectiveness of proposed approaches, and further areas of deep enquiry for assurance that security innovations translate into sustainable protection in the real world.

Analysis of Existing System and Application Security Mechanisms

Modern defenses are integrated predictive, detective, and mitigating security controls throughout the software lifecycle. Secure-by-design and secure software development life cycle, or SDLC, practices such as threat modeling, dependency management and automated static application security testing (SAST) and dynamic application security testing (DAST) integrated into continuous integration/continuous deployment (CI/CD) at development time help minimize the root cause of vulnerabilities by catching the flaws early on and enforcing coding standards (Singh, 2025). Research showed that SAST/DAST/IAST layering is beneficial to enhance the coverage of the source, build, and runtime contexts, as well as best seen combined with developer education and pipeline gating (Oluwaferanmi & Liang, 2025). The controls are essential tools to ensure the protection of system and application security.

Modern security of systems and applications is more and more based on layered defenses that are also runtime aware and can detect and mitigate the threat as it happens in complex software environments. Web application firewalls (WAFs) and runtime application self-protection (RASP) are adaptive reinforcements to malicious inputs or deviations from the control flow in real-time (Oluwaferanmi and Taofeek, 2025). Several peer-reviewed works have demonstrated the merit of using RASP in certain situations where the threat model of an application to be protected is particularly dynamic or situations where one needs to mitigate an attack immediately and in context-aware ways (Riera et al., 2022; Seth et al., 2023). 

For example, the approach has been practical to stop the injection or session hijacking attempts, and then note that the false positives and performance tradeoffs must be invariably managed (Hoxha et al., 2022).  Memory safety controls and control flow protections are used to address a dominating class of attacks at the system level. The techniques of address space layout randomization (ASLR), data execution prevention (DEP/ NX), and control flow integrity (CFI) make it a lot more costly to perform a memory corruption attack and code reuse attack (Ayman and Zoghby, 2025; Canakci et al., 2020). 

Contemporary studies have brought to attention CFI variants being some of the compiler-assisted mitigations, generally working well but incomplete; complementary hardenings, and may require incremental deployment strategies in big codebases (Houy & Bartel, 2024). Collectively, the protections are making it extremely important in mitigating cybersecurity threats.

Software supply-chain controls have become increasingly important. Software bill of materials (SBOM) practices, for example, have been combined with provenance tracking and automated scanning of third-party components (Nocera et al., 2025). The combinations provide a faster, evidence-based patching and risk triage experience. Systematic reviews for the years 2020-2025 have focused on SBOMs as helpful enablers for transparency and vulnerability management. However, the mechanism also acknowledges the barriers to adoption, such as tooling fragmentation and incomplete metadata (Stalnaker et al., 2024). 

Finally, there are architectural and organizational measures for bringing technical controls. Zero-Trust Architecture rethinks protection, and it is based on unceasing checks of identities and device posture, least privilege, and segmentation of access, reducing the need for perimeter defenses (Kang et al., 2023). Analogous operational mechanisms, endpoint detection and response, behavioral telemetry, automatic patch orchestration, and incident response playbooks are used to transform the point of detection to contain it quickly (Gundaboina, 2025).

Recent peer-reviewed work gave an equal platform for integration and mature processes measured with metrics against any single technical control (Kang et al, 2023). In other words, there are several layers of effective system and application security. Build time prevention, Runtime enforcement, memory and platform hardening, supply chain transparency, and Zero Trust operations validated in the literature to be necessary but not sufficient.

Emerging Research in System and Application Security

Recent research in the fields of system and application security has given particular attention to the improvement of defenses against machine learning (ML) and the security of software supply chains, as well as hardening protections at the systems level. Machine learning techniques have found broad applications in cybersecurity applications like intrusion detection and malware classification (Gupta et al., 2022).

Budiansyah et al. (2025) gave a broad survey that depicts the effectiveness of ML techniques in Anomaly detection, but still highlights the weakness to adversarial attacks. In the same line, Muthalagu et al. (2024) analyze evasion and poisoning attacks against ML classifiers and propose some robust adversarial training methods to mitigate such threats. 

Similarly, Deshmukh (2024) also reviewed the security evaluation of ML systems, which also emphasises the need for the usage of explainability and trustworthy AI as a necessary step towards countering adversarial manipulations. In particular, certified defenses with provable robustness guarantees were introduced by Ziras et al. (2025); the approach is a considerable step towards the deployment of secure ML models. The research provides support for robust measures for data protection and security.

The SolarWinds and Log4j incidents have spurred research in the area of software supply chain integrity. O’Donoghue et al. (2025) discussed how SBOMs help to enhance the transparency in the supply chain and help in assessing the risk, while Bodipudi (2022) introduced automated tracking of provenance, which is integrated into CI/CD pipelines for attestation in real-time and mitigation of vulnerabilities. 

Scott (2022) conducted a systematic review of the issues against the adoption of SBOM, such as standardization of metadata and tooling gaps, and Okafor et al. (2022) discussed socio-technical aspects related to the supply chain security practices and recommended the application of SLSA standards to increase organizational resiliency. Memory safety and control-flow integrity remain very hot topics for research. The work of Canakci et al. (2020) provided an illustration of formal verification techniques that can be used for the enforcement of CFI that reduce the exploitative attack surfaces very well. 

Hardware-Assisted Mitigations, such as the control flow enforcement technology offered by Intel, have been assessed by Kumar et al. (2022), and the strategies have been proven to be practical with significant security benefits. Park and Choi (2025) presented advanced kinds of fuzzing that combine symbolic execution with instructions on code coverage. The strategy includes enhanced vulnerability discovery for complex binaries and Internet of Things (IoT) firmware.

Best Practices in System and Application Security

System and application security has become one of the highest priorities in every organization, regardless of the field of operation, in the face of fast changes that are occurring in today’s digital society. Since now the complexity and pace of cyber threats have already been brought to a high pitch, the protection of sensitive data, confidence of the users, and ultimately continuity of the business critically depend on robust and adaptive security measures (Le et al. 2025). 

Best security practices in systems and applications cover a broad area of technical, procedural, and organizational methods of minimizing the possibility of vulnerabilities and attacks, providing timely detection, and quick response in case of any such anomalies and attacks. The review covers the critical domains and identifies evidence-based approaches to enable organizations to design secure and sustainable systems that are capable of withstanding dynamic threat landscapes.

Integrating Security Throughout the Development Lifecycle

One finding that is emerging most consistently in recent literature has been the need for security to be integrated throughout all phases of the SDLC, instead of being added at the tail end. The reviews by Kudriavtseva and Gadyatskaya (2022) illustrated the fact by summarizing 28 secure-software-development methodologies (SSDMs) from industry, government, and academia on how each phase of the software development process, from requirements, design, to coding, testing, deploying, and maintaining the software, should incorporate security practices—another recent study about a concrete methodology to support developers from security awake design through secure testing. 

The study once again reinforces the point that security needs to be built into the earliest decisions in the design process, rather than added late on (Casola et al., 2024). The studies highlight “security-by-design” as a basic best practice. When security is a first-class concern, right up there with functionality, organizations can significantly limit the introduction of security vulnerabilities and technical debt. Furthermore, empirical evaluations are gaining momentum that early integration of threat modeling, secure architecture patterns, and automated verification tools results in far fewer downstream defects and lower remediation costs. As organizations scale software portfolios, it becomes not only essential to have proactive measures throughout the SDLC for resiliency but also for ensuring the longevity of the security efforts in their organization.

Using Program Analysis, Static & Dynamic Testing to Catch Vulnerabilities Early

Automated program analysis, both static and dynamic, has become increasingly seen as essential to adequate security. A recent empirical study from industry highlighted that the tools that seamlessly integrate into developer workflows, have low false-positive rates, and scale to real-world codebases, have the best chance of adoption (Cifuentes et al., 2023). To complement both the traditional static and the dynamic approaches, some new hybrid approaches are beginning to appear. 

For example, large language model (LLM ) assisted static analysis for detecting security vulnerabilities shows that the integration of large language models into static analysis allows for the detection of more vulnerabilities than classical static tools (Li et al., 2024). In practice, however, the best security is achieved through the layering of multiple analysis strategies: static analysis, dynamic testing (such as fuzzing), manual secure code review, and hybrid ML-assisted tools, which will allow for expanding the coverage of security analyses and uncovering shallow as well as deep bugs.

Secure Coding, Code Review, and Human‑Centric Practices

Automated analysis is not enough in and of itself. Human practices, secure coding standards, peer review, and developer education remain of paramount importance. The multivocal review of SSDMs highlights the importance of non-technical practices such as organizational policy, governance, training, and processes being just as important as the technical controls (Kudriavtseva & Gadyatskaya, 2022). In the area of alignment, secure code reviews are still a critical touchpoint. 

Recent papers on code slicing for vulnerability detection have found that lowering the code that needs to be reviewed (e.g., through method-level slicing) leads to better vulnerability line detection, which enhances the ability of humans to find vulnerable lines (Papotti et al., 2025). The results also suggest that organizations should ensure they apply secure coding standards, perform peer reviews of the code regularly, with instruction on the relevant slices of code and a culture of shared responsibility, rather than viewing security as an afterthought or the sole job of the “security team. 

The developers would be assisted by ongoing education and awareness programs, which also help developers to keep abreast of the emerging threats and secure development techniques, making them more proactive towards security. The human-centred practices are, in turn, a great complement to the automated tools, creating a more robust and security-sensitive development environment.

Supply Chain Security, Traceability, and Software Composition Awareness

With modern applications being delivered using third-party libraries and third-party components, security of the supply chain has become an important best practice area. A recent systematic review revealed that the usage of SBOMs helps in managing vulnerabilities, assessing components, risks, and supply-chain integrity, but also reveals widespread barriers to adoption, for example, tooling gaps, format standardization, and maintenance overhead (O’Donoghue et al., 2025). 

Complementary work, for example, the study by Lee et al (2025), such as the translation of abstract security standards and regulatory requirements into concrete operational tasks throughout the SDLC, including supply chain as well as vulnerability management practices. The results endorse the best practice of introducing awareness of the supply chain into standard development workflows and generating and maintaining SBOMs, tracking of provenance, verification of third-party dependencies, and integration of supply chain checks into CI/CD pipelines (rather than having as optional or external audit items). 

Research also showed that the automatic process automation by continuous monitoring and real-time alerting serves the purpose of significantly reducing the window of exposure to vulnerable components (Team & Taylor, 2025). The proactive and integrated approach improves the security posture of the organization while gaining more trust in the larger software ecosystem.

Architectural & Operational Security

Beyond practices during the development phase, architectural and runtime defenses will also be key ingredients for modern system and application security. A recent comprehensive review suggested that the ZTA paradigm, with the elimination of implicit trust and continuous verification across devices, users, and network zones, is increasingly being used for a range of other applications such as cloud, IoT, healthcare, and enterprise (Mushtaq et al., 2025). Moreover, work done by Bohrme et al (2024) made a case for a combination of static and dynamic protections, runtime monitoring, behavioral analysis, and automated vulnerability assessment to create resiliency in evolving threat environments.

The findings provide recommendations on best practices, including designing systems around a zero-trust system, implementing defense in depth, decommissioning trust boundaries through monitoring runtime and detecting anomalies, and continuously validating instead of pre-deployment assurance of trust boundaries. Recent work also underlines the need to integrate hardware-rooted trust mechanisms, such as TEEs, to protect sensitive computations even in the case where the larger system is compromised (Cecilio et al., 2025). Collectively, the architectural and runtime strategies reinforce the concept that modern security should be a dynamic, ongoing process that anticipates failure and ensures resilient recovery at all levels of operation.

Benefits and Costs of System Application Security

Investments in systems and application security pay basic returns in the form of protection of organizational assets, user privacy, compliance with regulatory regimes, and operational continuity. Seh et al. (2020) emphasized that proper security reduces the cost of incident response and the associated reputational damage in case of data breaches. Strong defenses also make organizations confidently adopt digital transformation initiatives such as cloud computing and IoT deployments by mitigating inherent risks that they present (Saeed et al., 2023). Adopting best security practices helps to build customer trust and thereby, a competitive advantage. The protection is critical in areas such as finance and healthcare, where the data can be sensitive.

The protection mechanisms involve high costs. Comprehensive security demands a serious investment in tooling, expertise, and maintenance costs (Malik et al., 2024). Zaid and Garai (2024) further added that inserting security in existing development pipelines creates complexity and may slow down the release cycles if not handled appropriately. Moreover, too much reliance on automated tooling without proper human oversight can generate false positives or missed vulnerabilities and, hence, poor use of resources. Supply chain security, although of paramount importance, creates additional challenges linked to the need to constantly track third-party components and manage SBOMs, causing additional operational overhead and frequently creating new workflows (Nocera et al., 2025). Withdrawing the Challenges is Important to make the protections effective.

Recent studies have advanced a holistic, risk-based approach for the improvement of implementation to balance the security rigour with business agility. Santos et al. (2025), the authors suggested prioritizing the security controls based on threat modeling and criticality of assets, therefore enabling focused allocation of resources. Integration of security tools as part of DevSecOps pipelines enables support for automated testing of security continuously without an undue delay of the deployment process (Team & Taylor, 2025). 

Haney and Lutters (2020) said that upskilling of the workforce and the creation of a culture of security awareness are key to creating complementary technical defenses. The approach is considerable as the strategy increases the effectiveness of the security mechanisms.

 Increasingly, vulnerability detection that utilizes machine learning will be able to do more with less human power. Integration of CI/CD Workflows Could Reduce the Complexity of Supply Chain Security Using Automated SBOM Generation and Real-time Provenance Verification. Finally, the adoption of zero-trust architectures and layered defense-in-depth models contributes to runtime security by providing resiliency in case some of the controls break down (Kang et al., 2023). 

Therefore, while system and application security are about making thoughtful cost-benefit tradeoffs, taking to an extreme advantage adaptive, risk-informed strategies embodying automation, culture, and architecture improvements can be used to optimise protection, while keeping operational disruption to an absolute minimum.

Besides the direct organizational benefits, investments in system and application security are also achieving the wider ecosystem resilience in terms of reducing the systemic risks of interconnected digital infrastructures. Current research highlighted that vulnerabilities in the popular library, in the cloud platform, and in the IoT systems can impact the cascading failure of the sectors, hence highlighting the importance of sharing the responsibility for security (Almutairi & Sheldon, 2025). 

For example, research by Vale et al. (2021) identified insecure API integrations that are common in microservice and cloud native architectures might lead to propagation of breaches to other dependent services, increasing the impact.

Current literature suggests the interconnection of modern-day digital ecosystems, in which platform-level security becomes an essential component of organizational and global resilience. Containerized environments and Kubernetes security studies showed that flaws in configuration and insufficient isolation controls can endanger entire clusters; it is necessary to harden them proactively and continuously monitor them (Ambros, 2025). 

Moreover, the research comes after empirical analyses of IoT ecosystems in which poor authentication of devices at the device level and inadequate management of firmware opens not only single organizations to danger, but also creates conditions for the creation of large botnets. The findings confirm that investment in security goes far beyond internal compliance because such investments act as significant factors in reducing collective exposure within the digital supply chain and increasing global cyber stability.

Strengths and Weaknesses of System and Application Security

In this day and age of connected technology and continuous change in software development, the use of cloud services, open-source dependencies, and continuous deployment is the new normal. Systems and applications are becoming more reliant on security (Nocera et al., 2025). 

Research is an attempt of concerted efforts in the face of challenges. New defensive abstractions, more powerful analysis tools, and supply chain transparency are a few areas of inquiry. Nonetheless, the gap between the potential of research and the potential of deployment in the real world continues to be huge. A clear-eyed evaluation of strengths and weaknesses throws a light on where security research provides value as well as where caution or more work is required.

Strengths

System and application security research has great strengths regarding methodology range and technical innovation. Researchers have succeeded in combining machine learning, formal methods, program analysis, and hardware-backed isolation in their attempt to attack long-standing security problems from multiple angles (Jedrzejewski et al., 2024). The adversarial-ML literature has come of age and now consists of well-thought-out empirical and methodological research, which enhances detection and rigorously examines failure models such as evasion, poisoning, and backdoors, resulting in deployment-aware evaluation frameworks and robustness techniques that are industry relevant. 

Recent systematic studies reinforced the practical relevance and methodological rigor in the study of AML, which moved research in this field from toy examples to realistic models of threat (Jedrzejewski et al., 2024). The models are playing a significant role in threat detection and mitigation.

Progress at the systems level (the form of formal verification and microarchitectural control-flow integrity – uCFI) has resulted in provable, huge reductions in classes of exploitable bugs. The progress of which is shown by work just in 2024 on microCFI, which formal specification of microarchitectural properties followed by verification, is now able to prevent subtle hardware timing and control flow violations that were previously not possible with software-only mitigations (Seitz et al., 2024). 

Similarly, coverage-guided and symbolic execution have been developed further in order to cover the coverage-guided and symbolic program analysis and fuzzing research, respectively. Empirical ICSE/USENIX studies have found statistically significant increases in the coverage and bug finding on complex targets, such as kernels and firmware. The developments are representative of a healthy and rigorous pipeline from theory to evaluated tooling.

Another important strength is the increased focus on supply-chain and runtime assurances. Peer-reviewed studies on software bill of materials and provenance demonstrate that software transparency tools can significantly accelerate vulnerability triage and patching processes. Large-scale cross-stakeholder research and ACM analyses identified practical ways to incorporate SBOM generation into CI/CD and automate workflows for attestation (Stalnaker et al., 2024). 

Confidential computing and trusted execution environment (TEE) reviews also combine hardware and cloud vendor innovations with formal analyses on the guarantees and limits to assist practitioners in reasoning about when and how to use TEEs. The socio-technical/operational studies enable bridging academic insight and real-world deployment concerns.

Weaknesses

Despite the strengths, there are a number of important weaknesses. The first is the weakness of the deployment gap and reproducibility. Many state-of-the-art techniques, such as formal verifiers, ML defenses, or hybrid fuzzers, have been tested on the curated benchmarks or the medium-sized codebases; the scalability and costs of maintenance in the heterogeneous enterprise environments have not been extensively studied. Systematic reviews of adversarial ML and industrial AML research cited recurring problems with reproducibility, realism of datasets, and a lack of standardized benchmarks simulating adaptive, red-team adversaries (Jedrzejewski et al., 2024). The issue needs to be addressed for an increase in the efficacy of the protection mechanism.

Second, the lack of standardization of tooling and fragmentation blocks widespread adoption. Research into SBOMs and supply chain assurances has documented fragmentation in the format, metadata completeness, and toolchains that are pragmatic barriers to the utility of SBOMs for large organizations and make automated remediation complicated (Stalnaker et al., 2024). Interoperable standards and easier integration into CI/CD. Translating research prototypes into operational practice.

Thirdly, human and socio-technical factors are also understated. In a context where technical controls are developing at a fast pace, the literature shows a lack of longitudinal studies about developer behavior and organizational change and governance needed to embed security practices as a sustainable one. Most of the papers suggested upskilling developers and process redesign; however, few have tried interventions, and few have measured long-term adoption metrics (Geppert et al, 2022). A critical need to mitigate the issue to be able to make full use of the mechanism for security is present.

Finally, there are current research frontiers, which are active ones, for example: residual threat vectors, in particular, supply chain provenance holes, hardware side-channel against TEEs, and adaptive adversaries against ML. Review of the confidential computing murky threat models around attestation and side channel resistance adversarial-ML surveys highlights that certified defenses are promising but incomplete and often expensive. 

The interplay of the residual risks with the operational constraints — cost, latency, legacy systems — is such that these issues require sustained attention across disciplines. In all, system and application security research reflects strong technical development and an increasingly practice-oriented work, but permanent gaps in the fields of scalability, standardization, socio-technical integration, and realistic evaluation of adversaries limit the conversion of many advances into a wide-ranging operational impact. Overcoming the weakness will require coordination for benchmark realism, interoperable tooling, longitudinal socio-technical research, and provenance and attestation standards.

Conclusion

The body system and application security research represent excellent technical development, while on the other hand, research reflects shortcomings in the ongoing need to overcome. Advances in machine learning have allowed for threat detection, hybrid fuzzing, fine-grained control flow integrity, and software supply chain transparency, which overall improve our defense toolkit and progress towards automated and scalable defenses. 

However, some challenges, including a lack of validation in the real world, inconsistent standardization, evolving attack vectors, and a lack of integration with organizational and human-centric processes, put boundaries on the practical effect of many proposed mechanisms. For example, without regular updates to reflect emerging threats, even well-designed security mechanisms quickly become obsolete. Future research is required to be more focused on deployability, applicability in several platforms, and holistic security, linking technical controls with operational realities. Only by bringing innovation and reality (actual implementation) in line with each other, the field will be able to move in a meaningful way towards appropriate, sustainable system and application security in ever more complex digital environments.