02 | Instrumentation offers a path forward
Key to a strong AppSec platform is uniting development and security. An instrumentation-based approach to application testing can help realign development and security objectives while eliminating counterproductive workflows that slow down development and operations. It’s similar to the parallel approach taken to solve application performance testing (accomplished by the likes of New Relic and AppDynamics, among others).
Here, dynamic byte code instrumentation helps identify vulnerabilities inside running applications. It can protect applications in the same ways that smoke detectors and fire suppression systems protect buildings. As an application starts up, an agent automatically places instrument sensors at specific locations within the application code (including libraries, frameworks, and application servers) to observe operating conditions and ensure safe operation. If an outside threat seeks to exploit a vulnerability, sensors can detect the activity in real time and respond accordingly.
"By 2022, 10% of coding vulnerabilities identified by static application security testing (SAST) will be remediated automatically with code suggestions applied from automated solutions, up from less than 1% today."5
Runtime applications protected by security instrumentation.
Following are Some of the Core Capabilities Needed in an AppSec Platform:
AUTOMATION OF APPSEC.
Instead of an asynchronous development and testing loop that impedes time to market, instrumentation-based security becomes a parallel process that automatically launches with applications under real-world operating conditions. This provides direct, real-time vulnerability analysis and threat telemetry to improve application security without slowing down DevOps. This also reduces the demand on overburdened security teams to ensure validation under the pressure of delivery—at a time when the majority (65%) of organizations report a shortage of cybersecurity staff.6 And at the same time, these capabilities dynamically scale across any number of deployed applications.
DISCOVERY, VISIBILITY, AND VERIFICATION OF VULNERABILITIES.
The old adage, “You can’t secure what you can’t see,” applies here. Organizations need to know where all the software in use is running. Instrumentation supports automatic software inventory to track all applications, APIs, libraries, and frameworks across all environments (e.g., production, test servers, development servers) with 24x7 monitoring and risk management.
POLICY-BASED SECURITY CONTROLS.
Like physical sensors in a factory, instrumentation measures the operating conditions within an application—allowing organizations to then set policies in the event that a potential event is detected. Policy-based control responses range from alerts with detailed contextual analysis or real-time remediation actions to prevent an attack from spreading.
INTEGRATIONS AND REPORTING.
Organizations should treat security vulnerabilities the same way as they do other bugs. The era of PDF-based security reporting is over. Modern application security works through instant notifications and alerts, sending details immediately into the tools that development and operations teams are already using. This enables quick remediation at the lowest cost possible.
"Over half of cybersecurity professionals indicate their organization is at moderate or extreme risk due to staff shortages, and AppSec is an area where the gaps are the most glaring."7
03 | Choosing on instrumentation platform
As part of a unified platform that can add on capabilities as requirements grow, an effective instrumentation-based solution for AppSec should include three main functions:
- Interactive application security testing (IAST), which is run in preproduction, detects vulnerabilities in both custom code and libraries during normal use by gathering data from running code.
- Software composition analysis (SCA) analyzes libraries to identify potentially vulnerable third-party and open-source components. This is particularly important with 84% of applications consisting of more than half open source code.8
- Runtime application self-protection (RASP) is run in production to verify queries and prevent vulnerabilities from being exploited inside the application (both custom code and libraries). Because RASP runs inside the app itself, it provides more effective protection than a web application firewall (WAF), which sits in front of the application.
Instrumentation enables continuous application security (secure, analyze, verify, defend) for working applications across all critical points in the development process (Figure 1).
Figure 1: Instrumentation of AppSec involves four key security components: secure, analyze, verify, and defend.
Security teams must also understand privacy ramifications and where compliance plays a role.9 Instrumentation enable organizations to comply with security and regulatory standards such as Federal Information Security Management Act (FISMA), National Institute of Standards and Technology (NIST), Payment Card Industry Data Security Standard (PCI DSS), and Open Web Application Security Project (OWASP).