Posted on

Issues with AppSec

To understand the current and future state of application security, we obtained insights from five IT executives. We asked them, “What are the most common issues you see with application security?” Here’s what they told us: 

  • Two issues are the human attention span and the accuracy of automated systems. People who monitor or engage with security need to focus time and effort on things that matter and produce outcomes that serve a purpose. They cannot do that without accuracy, and accuracy comes from application-insight. The other is automation systems, where simply sending data is not helpful. Data must be relevant, with enough metadata to properly act. This relevance is tied to the application's insight.
  • There are so many guidelines right now. Authenticity, authorization, encryption, and availability mechanism – ensure all four are done with discipline and automation. Do the fundamentals well on APIs and mobile and modern web to avoid the majority of data breaches. When security hooks up with DevOps, it’s an impedance mismatch that causes a lot of friction.
  • The most common issue I see is doing nothing to secure your applications, followed closely by taking too narrow an approach to application security (for example, looking at security from only one perspective, such as static code analysis) and falling prey to a false sense of security. I don’t have the data to identify which is the largest actual risk based on break-ins, but I wouldn’t be surprised if the latter point is more critical.
  • We commonly see applications that are designed with security principles in mind but not from a network perspective. How an application acts on a single node in a network is different from how it behaves as it traverses the LAN and WAN. Our solution helps customers keep applications secure as they traverse networks, both local and wide-area.
  • Don’t use tools. AppSec testing technology today can come as a tool or a cloud service. Technology emerges first as a tool you learn to use, run, and be responsible for its accuracy and breadth. The next wave is when the technology is delivered as a cloud service. Now, we have more services than tools. Adopt technologies like cloud services rather than tools. Delegate AppSec to third-party vendors operating at high scale in the cloud.

Here’s who shared their insights:

Posted on

AppSec Key Elements

To understand the current and future state of application security, we obtained insights from five IT executives. We asked them, “What are the most important elements of application security?” Here’s what they told us:

  • Visibility is crucial; if you can’t see what’s going on, you don’t know where to act. This is why our perspective inside the application is so crucial.
  • Have empathy for the developer. 80% of our companies are developers. Remember what developers have to do — make something that’s relevant, useful, popular, with features, scalable, performant, and secure. Start by understanding that developers have a lot on their plate, and think about how to make their lives as easy as possible. Take the AppSec concern. Ensure that it's consumable and actionable by a developer. If you can form the issue as a bug with direction on how to fix the bug, if you create a form like a JIRA ticket, then you’ve gone as far as a security leader to find issues and make it actionable to fix quickly.
  • Application Security improves as you look at your application deliverable from various perspectives. It’s important to shift left so you get feedback on security vulnerabilities as a developer is coding and includes dependencies into their project — this can be done through IDE plugins (like Nexus Lifecycle).

    At the same time, shifting left doesn’t remove the need for centralized static application security testing (SAST) and dynamic application security testing (DAST), since these techniques can bring different violations to light. Monitoring for attacks in production is a very useful technique as well, as on average, companies take about 197 days to identify and 69 days to contain a breach according to IBM, which clearly shows us that there’s significant room for improvement. New, innovative security solutions even allow you to install agents into the runtime of applications running in production, which monitor critical segments in code and put them in a walled garden, so that even if a malicious user manages to trigger an exploit, they’ll be cut off instantly. The most important element is to not ignore application security completely and to use a multi-perspectival approach since each perspective yields subtly different insights.
  • We have found a holistic security mindset is crucial in every aspect of an application’s development and operation. Continually testing, scanning, and verifying applications is the best way to ensure their secure operation.

    Two are tasks: secure the application lifecycle and secure the application operation. The first part is injecting application security in all phases of the lifecycle. We need to test applications at programming and build phases when collecting elements, at deploy, throughout production, and through the decommissioning of the application. It’s all about detecting vulnerabilities. Once it’s up and running, it's less protected. RASP is a technology I defined in 2012. It’s being adopted very slowly, as it requires instrumentation in a runtime environment.

Here’s who shared their insights: