What's Your AppSec Personality?

Your business relies on software, and attackers know that. To prevent your applications from being used against you, you need an application security (AppSec) program that delivers three crucial things:

• Secure code: Your code has to be vulnerability-free and well-defended.
• Secure software supply chain: Ditto for your libraries, products, and dev tools.
• Secure operations: You must detect attacks and prevent exploits in production.

You can choose a number of paths to get to that level of protection. Which path you choose depends on your teams, processes, technology, and culture. How do they all work together? Keep in mind that an AppSec program isn’t about eliminating risk. Business involves taking risks, and there’s no way to completely eradicate it. But there’s a big difference between taking blind risks while not knowing what could go wrong vs. being aware of how likely it is that an issue will be found and exploited, as well as how catastrophic (or not) the outcomes might be.

When it comes to risk decisions, choosing a strategy for your AppSec program is the most important one you’ll face. Setting up an AppSec program is nuanced and varied, but consider which of the following three general types best fits your company. The wrong path could leave you with a massive weight of security debt, or even possibly breached, because time was wasted chasing vulnerabilities that weren’t all that relevant and real risks got buried in the “never got to it” pile.

1. The Auditor: Checkbox AppSec

In “minimal” AppSec programs, small teams do only what’s required of them by either external standards or their customers. The goal is to simply check off the boxes for application security standards like OWASP, PCI, and NIST, all of which are, essentially, checklists. Many types of companies adopt this strategy — most commonly, small and midsize businesses — but the checklists don’t bring them actual security.

It’s not that minimal AppSec programs never succeed. They can by relying on free or very inexpensive tools, such as OWASP ZAP and DependencyCheck, to assess code. An inexpensive cloud web application firewall (WAF) for production might also be in the mix. But these tools can show false-negatives that miss real vulnerabilities, giving organizations a false sense of security. Such tools also tend to throw false-positives that lead to squandered resources and huge backlogs instead of actual remediation.

An upside to having a minimal AppSec program is that the budget for people and tools tend to be small. But because minimal AppSec programs don’t offer a clear understanding of business risk, organizations are underinvesting in enterprise security based on incomplete information.

2. The Lawyer: Adversarial AppSec

In adversarial AppSec programs, the development team tries to deliver code as fast as possible while the siloed security team wrestles for control. Development focuses on delivering features, while the security team tries to add more security activities. Large companies tend to adopt this approach, as do critical industries such as finance, banking, e-commerce, and insurance.

This approach requires a large security team to execute all of the activities. Most have various subteams focused on architecture, policy, threat modeling, policy, static scanning, dynamic scanning, WAFs, training, and more. Adversarial programs always have more analysis to do, but security teams don’t actually fix code in this type of program. Organizations often adopt “champion” programs to help get all of the work done. But without a clear line of sight from activities desired outcomes, much of the busy work has little to no measurable effect.

Given a big enough team and a big budget, adversarial AppSec programs can be effective. But most programs struggle to handle the volume of tool output, particularly as development teams speed up their software releases. Most vulnerabilities wind up in an ever-growing pile of issues that are neither triaged nor remediated. Development teams are confronted with significant delays and bottlenecks due to these backlogs, which are coupled with security testing and gates. Innovation suffers because of these delays, which cause frustration and force development teams to seek exceptions and bypass security.

3. The Developer: Developer-Centric AppSec

Developer-centric AppSec programs strive to put application security directly into the hands of software development teams as part of their regular work. The goal: for the teams to eventually establish an automated pipeline that ensures strong security across the software development life cycle, starting with the developer and on into production. This type of program is often called “DevSecOps,” or “shift left.”

DevSecOps programs use the “big machinery” of software development to do security work, as opposed to smaller, siloed AppSec teams. Given that developers won’t tolerate slowing down pipelines or wasting time on false-positives, developer teams automate security testing in pipelines, using fast and highly accurate tools that enable fast security feedback loops and reduce cost.

Developer-centric programs employ interactive application security testing (IAST) tools to simultaneously perform fully automated security and quality tests. Doing so aligns development and security interests, as the teams work together on expanding test coverage and strengthening the pipeline. Visibility into attacks with runtime application self-protection (RASP) also provides teams with threat intelligence that informs security priorities. RASP technology prevents vulnerabilities from being exploited, allowing teams to respond to new vulnerabilities without having to run a fire drill.

The developer-centric approach is ideal for projects regardless of their stage in DevOps transformation. That said, this approach may not be able to take advantage of automated pipelines, quality testing infrastructure, and DevOps culture if applied to completely traditional projects. Then again, adopting a developer-centric approach to security may be the perfect catalyst to spark or to speed a DevOps transformation.

Software Security Has Changed

Inspired by incidents like SolarWinds, Log4Shell, and Spring4Shell, the world’s governments have been pushed into doing something about application security. New regulations and standards from NIST, PCI, and OWASP all require a more sophisticated approach to AppSec and real evidence that what you’re doing is actually effective.

Those employing a “minimal” or “adversarial” AppSec program will likely have to respond by making some changes, including:

• Threat modeling: The days of checklists are over. You’re going to need to threat-model your applications and then demonstrate that you’ve implemented decent controls for each.
• AST****: You’re also going to be expected to do a much more thorough job of testing the security of your applications and APIs. You’ll have to provide evidence that you’re testing the effectiveness of your defenses and remediating any problems found.
• SBOMs****: To really get a handle on your open source use, you’re probably going to need sensors that report library data to an always-up-to-date database. But in the meantime, you’ll also need to generate software bills of materials (SBOMs) for your customers.

Bear in mind that if you decide to change up your approach, transforming one team at a time is probably preferable to trying to change everything all at once.

The trend toward more transparent application security that goes beyond simply checking off boxes likely won’t stop here. The US government, for one, is evaluating a software security labeling scheme to create visibility and drive better security from producers. Whether this becomes reality remains to be seen, but one thing’s safe to say: Now is a fine time to make sure you’ve chosen the right strategy for application security.