Posted on

Statistics-Based OWASP Top 10 2021 Proposal

Everybody knows the OWASP Top 10 as well as the fact that it gets updated only every other 3-4 years. With the last update published in 2017, it’s no surprise that a new version is coming this year. During my application security career, I saw OWASP Top 10 at least in 2003, 2004, 2007, 2010, 2013, and 2017. 

Since the OWASP creation process is not documented well, it seems reasonable to build an open and transparent rating for the same categories based on a large number of security reports.

Posted on

DevSecOps and the Problem of Machine-Scale Data

Machine-scale data might overwhelm your DevSecOps implementation.

“Shifting Left” From DevOps to DevSecOps

When development teams using waterfall approaches couldn’t keep up with customer requirements, they adopted DevOps and Agile SDLCs. While these flexible approaches attempt to meet customer demands, security processes get left behind. You either skip security, or you aren’t really Agile. Either way, you’re losing the benefits of adapting rapidly to customer needs.

Now that new regulations and consumer awareness have made privacy and security a priority, the industry’s recognized that they need to be built into the SDLC. “Shift left” means integrating processes and testing that have traditionally happened at the end into the development process itself, and you often hear that term used to describe a transition from DevOps to DevSecOps.

Posted on

Are You Prepared to Handle Security Breaches for Web Applications?

Take security threats where they belong

Chances are, while you’re reading this, there are frantic boardroom meetings happening in some parts of the world. Imagine CxO’s shivering to their bones, urging their IT security teams to "do something" about the web application security breach they’ve been hit by. That’s how web application security breaches are.

You may also like Why Framework Choice Matters in Web Application Security.

What do the numbers say?

Posted on

Issues with AppSec

To understand the current and future state of application security, we obtained insights from five IT executives. We asked them, “What are the most common issues you see with application security?” Here’s what they told us: 

  • Two issues are the human attention span and the accuracy of automated systems. People who monitor or engage with security need to focus time and effort on things that matter and produce outcomes that serve a purpose. They cannot do that without accuracy, and accuracy comes from application-insight. The other is automation systems, where simply sending data is not helpful. Data must be relevant, with enough metadata to properly act. This relevance is tied to the application's insight.
  • There are so many guidelines right now. Authenticity, authorization, encryption, and availability mechanism – ensure all four are done with discipline and automation. Do the fundamentals well on APIs and mobile and modern web to avoid the majority of data breaches. When security hooks up with DevOps, it’s an impedance mismatch that causes a lot of friction.
  • The most common issue I see is doing nothing to secure your applications, followed closely by taking too narrow an approach to application security (for example, looking at security from only one perspective, such as static code analysis) and falling prey to a false sense of security. I don’t have the data to identify which is the largest actual risk based on break-ins, but I wouldn’t be surprised if the latter point is more critical.
  • We commonly see applications that are designed with security principles in mind but not from a network perspective. How an application acts on a single node in a network is different from how it behaves as it traverses the LAN and WAN. Our solution helps customers keep applications secure as they traverse networks, both local and wide-area.
  • Don’t use tools. AppSec testing technology today can come as a tool or a cloud service. Technology emerges first as a tool you learn to use, run, and be responsible for its accuracy and breadth. The next wave is when the technology is delivered as a cloud service. Now, we have more services than tools. Adopt technologies like cloud services rather than tools. Delegate AppSec to third-party vendors operating at high scale in the cloud.

Here’s who shared their insights: