Application Security

Application security is the use of software, hardware, and procedural methods to protect applications from external threats. As applications are increasingly accessible via networks, they become vulnerable to a wide variety of threats. Security tools and testing can be applied throughout the software development life cycle (SDLC) to help reduce the risk of application-based exploitation that leads to the access, theft, modification, or deletion of sensitive data.

Security for applications can be divided into two main areas. Application security testing (AST) helps developers detect application vulnerabilities in custom code and open-source components so that they can be fixed in order to prevent exploitation. Applications also require security protection in production to defend against attacks from both known and unknown threat sources.

Why application security is needed

Application vulnerabilities continue to be exploited by an array of threat actors using increasingly sophisticated exploit methods. According to Verizon’s 2020 Data Breach Investigations Report, nearly half (43%) of all successful data breaches can be traced back to an application vulnerability—a share that more than doubled year over year. With the average total cost of a single data breach in 2020 reaching $3.86 million, unsecure applications present significant risk to the financial health and professional reputation of an organization.

Inadequate application security testing and protections allow cyber criminals to exploit application vulnerabilities. If applications fail to function or are vulnerable to cyberattacks, the intended benefits cannot be fully realized and organizations are at risk of critical data exposure and brand degradation.

How applications have become increasingly vulnerable

Organizations in every sector now depend on critical applications to run the various aspects of their businesses. The ever-increasing demand for new software innovations puts application developers under tremendous pressure to accelerate their delivery cycles. Many have embraced DevOps and Agile to accelerate development and delivery, but this has come at the cost of security. A majority of developers (73%) say they are forced to sacrifice application security for speed to keep pace with the demands of development cycles.

The problem stems from the fact that most traditional application security testing methods cannot keep pace with the complexity of modern applications or the scheduling demands of today’s development environments. Traditional scan-based application security testing depends on a co-dependent workflow between developers and security analysts, which creates a bottleneck in the pipeline. The need for frequent security scans impedes release cycles and increases developer inefficiencies.

Application security and risk management

Prioritized and precise risk management is also a key necessity for modern application security. Organizations need security tools and solutions that help DevOps teams to identify, assess, and prioritize vulnerabilities, enabling them to determine whether they need immediate mitigation or ongoing monitoring in accordance with the National Institute of Standards and Technology (NIST) Cybersecurity Framework as well as compliance with applicable privacy laws and industry regulations—such as the EU’s General Data Protection Regulation (GDPR) or the Payment Card Industry (PCI) standard.

Risk management extends beyond Common Vulnerabilities and Exposures (CVEs) and compliance violations. It also includes tracking the licensing complexities associated with high-volume reliance on open-source components. Open-source libraries and frameworks have become ubiquitous in development environments to help accelerate delivery of new software. Organizations that are unsure of their obligations under license can experience problems with intellectual property rights or monetary losses.

Traditional approaches to application security

Traditionally, application security was done from an “outside-in” vantage—vulnerability scanning of code, searching files, trying hacks, and attempting to identify attacks. These include:

• Static Application Security Testing (SAST)
• Dynamic Application Security Testing (DAST)
• Web Application Firewalls (WAFs)

These legacy tools were designed in a pre-cloud era and were not designed to keep up with size, complexity, and scale of modern distributed applications. They struggle to accurately test for vulnerabilities in development, keep track of open-source components, or protect applications in production. And they typically only provide a snapshot in time of an application’s security posture—rather than a continuous, real-time view.

Static application security testing(SAST)

Legacy SAST technologies are used early in the SDLC to scan the source code for coding and design vulnerabilities that make an application susceptible to attack. Developers can use SAST to analyze an application in a non-running state to gauge its security strength and find issues to remediate in development. But a SAST tool can only model predictions about a software’s vulnerabilities based on provided information.

Dynamic application security testing (DAST)

Legacy DAST is another “outside-in” approach that tests a running application's exposed interfaces looking for vulnerabilities, and flaws. A DAST tool may be able to evaluate some exposed parts of the application, but not all of its working parts. DAST is good at finding externally visible issues and vulnerabilities. But these tools heavily rely on security experts, which makes it difficult to scale DAST solutions.

Web application firewalls (WAFs)

WAFs are used to protect applications in production—specifically to filter, monitor, and block HTTP traffic to and from a web application. Organizations often deploy WAFs to detect and block known threats, but these alone cannot protect modern applications from exploitation.

Because WAFs sit in front of an application, they cannot see any context within the running code to determine if an actual exploitable vulnerability exists within the specific code. This results in a high degree of inaccuracy. Perimeter solutions are also not fully application programming interface (API)-enabled and require significant manual support from staff. In many instances, security teams complain they need full-time personnel to manage and tweak perimeter rules.

Instrumentation and advanced application security

With modern software becoming increasingly complex and distributed, application security needs to see how all parts of the code perform during runtime operations. To achieve this kind of comprehensive visibility, security must have an interior (rather than exterior) view of the application.

Security instrumentation at the application layer allows organizations to add a security agent component to the application code. The agent performs continuous, complete, and accurate security tasks without scanning—providing comprehensive security monitoring across the entire application attack surface. DevOps teams can observe applications in context and understand how they are functioning (as per the flow of data throughout the system) at any given time. Their remediation efforts can shift left, where vulnerabilities are instantly detected and immediately addressed by developers.

This approach also helps to synchronize the workflows and objectives of developers, operations managers, and security experts within the organization. Developers can remediate critical vulnerabilities without relying on outside input from security experts. As a result, application security objectives can more easily mesh with those of integrated development environments (IDEs) and continuous integration/continuous deployment (CI/CD) pipelines to accelerate delivery of high-quality code.

A modern application security platform deployed via instrumentation should include advanced solutions such as:

• Interactive Application Security Testing (IAST)
• Open-source Security (OSS)
• Runtime Application Self-protection (RASP)

Interactive application security testing (IAST)

Interactive application security testing (IAST) assesses custom code and third-party components in development. IAST solutions can automatically identify software vulnerabilities in real time as developers write code. This allows developers to find and fix vulnerabilities without requiring specialized review and recommendations from security experts.

Open-source security (OSS)

Open-source components saw an almost 50% increase in reported vulnerabilities last year. The key to effectively embracing open-source components and containers is to catalog and manage the risks. OSS uses software composition analysis (SCA) to gain full component visibility, analyze open-source libraries, and assess risks. An effective OSS solution can detect which open-source software components are called in the application runtime, if they are vulnerable, and whether they expose an organization to unnecessary security risks or legal problems due to licensing complications. It can also help track and manage open-source components licensing risks.

Runtime application self-protection (RASP)

Runtime application self-protection (RASP) prevents vulnerabilities from being exploited in production. RASP enables real-time analysis of application runtime events to confirm exploitability before taking action to block an attack. This accuracy virtually eliminates the problems associated with false-positive alerts.

This kind of post-release visibility helps development teams continue to learn about threats, vulnerabilities, and risks in order to facilitate continuous improvements to the code. Being able to aggregate data across the entire SDLC also helps streamline auditing and reporting processes in support of compliance requirements.

Application security at the speed of DevOps

Unless applications can be kept secure, they will remain liable to cyberattacks and therefore their full value to organizations cannot be realized. Traditional application security methods cannot keep pace with complex and distributed software designs. Their “outside-in” positioning obscures visibility, degrades accuracy, and relies on inefficient workflows based on human security analysis. An instrumentation-based approach to application security (featuring advanced solutions like IAST, OSS, and RASP) offers a path forward in terms of visibility, scalability, and DevOps workflow efficiency.