"End-user application development (EUAD) is nothing new, but the risks and opportunities it presents have become much greater in recent years," Ian Finley, research vice president at Gartner, says. "In the past, EUAD posed limited risks to the organization because it was typically limited to a single user or workgroup. However, end users can now build departmental, enterprise and even public applications. While this change enables organizations to empower end users and releases IT resources, it also heightens the risks of EUAD."

IT organizations need to adapt to the new realities of EUAD and build a citizen developer support program, the company recommends. While the potential for end-user application development is great, the risks to the business of poorly managed (or unmanaged) EUAD can be severe. Gartner predicts that by 2014, at least a third of enterprises without formalized citizen developer governance policies will encounter substantial data, process integrity and security vulnerabilities.

"EUAD is being transformed by several converging forces, including changing workforce demographics, the mass customization and maturation of service-oriented architecture, simplified tools for new development and the power of cloud computing for delivering IT capabilities to end users with no IT assistance," said Eric Knipp, research director at Gartner. "Fighting these forces is a losing battle, but a citizen developer program can reduce the risks and unlock potential in EUAD."

IT leaders should work with the business to identify just-enough governance to enable and protect citizen developers and mitigate risks such as the reproduction of similar applications, inadequate application life cycle management (ALM), the delegation of responsibility for failed projects to the IT department and the ignorance of best practices in security, performance, etc.

"If end-user developers are ignored, and they build applications without help or knowledge from the IT organization, then there is a real risk that they will fail miserably and create an unplanned burden for IT," Knipp said. "When an application is mission-critical - as often is the case with unmonitored tools used in business areas - the pain for the IT staff is even more acute. IT leaders must be proactive in managing citizen developer initiatives by providing tools that enable transparency in monitoring, change control and analytics. Even if IT is not at the wheel, it should keep a close eye on the dashboard."

IT organizations should manage the inherent risks of EUAD by educating citizen developers where they must tread lightly, and offer platforms with the "sharp edges" removed.

These 25 programming errors have been the cause of nearly every major type of cyber attack, including recent penetrations of Google, power systems, military systems, and millions of other attacks on small businesses and home users, says Sans in a press release. A global effort to eliminate these programming errors is the first step against organized cyber criminals, and the persistent threat from competing nation states.

The list prioritizes its entries using inputs from 28 different organizations who have evaluated each weakness based on prevalence and importance. It provides a small set of the most effective mitigations, helping developers reduce or eliminate entire groups of weaknesses. "There appears to be broad agreement on the programming errors," said Mason Brown, Director at Sans. "Now it is time for buyers to say we are mad as hell, and we are not going to buy software unless you get rid of these errors before you deliver it to us."

Cross-site scripting (XSS) is one of the most prevalent, obstinate, and dangerous vulnerabilities in web applications, according to Sans. It is closely followed by improper Sanitization of Special Elements used in an SQL Command ('SQL Injection') and Cross-Site Request Forgery (CSRF).

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') is a critical error in the Risky Resource Management section, followed by improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') and Improper Control of Filename for Include/Require Statement in PHP Program ('PHP File Inclusion').

Improper Access Control (Authorization) is listed as the number one risk in the category "Porous Defenses," followed by Reliance on Untrusted Inputs in a Security Decision and Missing Encryption of Sensitive Data.

The top 25 errors List is updated regularly and posted at both the SANS and Mitre sites. While Mitre maintains the CWE (Common Weakness Enumeration) web site, Sans maintains a series of assessments of secure coding skills in three languages along with certification exams that allow programmers to determine gaps in their knowledge of secure coding and allows buyers to ensure outsourced programmers have sufficient programming skills.

The Software Assurance Forum for Excellence in Code (members include EMC, Juniper, Microsoft, Nokia, SAP and Symantec) has produced two excellent publications outlining industry best practices for software assurance and providing practical advice for implementing proven methods for secure software development.

"If you build your application with features based on a user's location, make sure these features provide beneficial information. If your app uses location-based information primarily to enable mobile advertisers to deliver targeted ads based on a user's location, your app will be returned to you by the App Store Review Team for modification before it can be posted to the App Store," Apple said.

The company claims the GPS data can only be used to provide "beneficial information to users.” Looks like Apple is going to keep location-based advertising to them," said Twitterific developer Greg Hockenberry in a recent tweet.

One of the ad networks that has had success with in-app advertising on the iPhone is AdMob, a company Apple tried to get control over but that Google is now in the process of acquiring. Several news outlets reported that Apple is now in the process of acquiring mobile ad company Quattro Wireless, a direct competitor to AdMob. Sounds like that it's only a matter of time before Quattro will be the exclusive provider of in-app advertising on all Apple devices.

There are now more than 125,000 developers in Apple’s iPhone developer program. The company has sold more than 50 million iPhones and iPod Touch handhelds, according to its last quarterly report. The top download category is games with over 21,000 apps available, followed by entertainment and books.

At this time, real competitors are few. Google’s Android platform, which ranks number 2, has 10,000 applications available for download.

The engine has been launched with Google asking developers and businesses for feedback. Google said the infrastructure was updated to index new content on the web faster.

The public testing of the new Google engine comes two weeks after Microsoft struck a deal to replace Yahoo!'s search engine with Bing.

In a blog post, Matt Cutts, a principal engineer at Google and Sitaram Iyer, a staff software engineer, said: "For the last several months, a large team of Googlers has been working on a secret project: a next-generation architecture for Google's web search. It's the first step in a process that will let us push the envelope on size, indexing speed, accuracy, comprehensiveness and other dimensions.”

"The new infrastructure sits 'under the hood' of Google's search engine,” so Cutts, “which means that most users won't notice a difference in search results. But web developers and power searchers might notice a few differences, so we're opening up a web developer preview to collect feedback."

In a personal blog post, Cutts said that Caffeine was not specifically a response to Bing: "I love competition in search and want lots of it, but this change has been in the works for months. I think the best way for Google to do well in search is to continue what we’ve done for the last decade or so: focus relentlessly on pushing our search quality forward. Nobody cares more about search than Google, and I don’t think we’ll ever stop trying to improve."