Vulnerability Assessment

Cyber crimes are expected to cause more than 6 trillion dollars in damages in 2021. By the year 2025, it's estimated that the cost will go up to $10.5 trillion, making application security a top concern for organizations. According to the most recent Data Breach Investigations Report from Verizon, 39% of data breaches resulted from a web application vulnerability. Vulnerabilities are found throughout the software development life cycle (SDLC), from development to production. Quick detection before they can lead to a successful exploit is key to keeping companies safe from a data breach.

With help from a vulnerability assessment, organizations can test their web application infrastructures checking for weaknesses that could later lead to an application attack. Following a respective procedure is an industry standard that is becoming ineffective due to today's agile development environments. Organizations should look to automated approaches that help developers keep up with production demands without sacrificing the security of their applications.

What is a vulnerability assessment?

A vulnerability assessment is a planned process used to reveal application vulnerabilities. Security analysts use a database of known vulnerabilities and details about the application’s infrastructure to configure vulnerability assessment tools. Once configured, these tools are used to scan applications for vulnerabilities to give details about issues both in development and in production. Organizations benefit from catching vulnerabilities early in the SDLC when remediation is cost-effective and will not hold up production. Carefully planned and executed vulnerability assessments can protect against several common severe OWASP application threats including:

SQL Injection Attacks

SQL injection attacks pose the largest risk to organizations by targeting vulnerable queries. When an exploitable vulnerability is detected, attackers can insert malicious injections that get processed by databases to execute desired results. SQL injections can allow cyber criminals to come into contact with sensitive data and other information that could put users and systems in jeopardy.

Cross-site Scripting (XSS) Attacks

Cross-site scripting (XSS) attacks are another large threat to organizations, listed as one of the top four highest risks. Attackers target vulnerabilities in browser-side scripts, attempting to gain access into unauthorized areas. If attackers are successful in manipulating code, they can trick web applications into sending malicious code to a different end-user, either crashing the application or stealing sensitive data

Session Hijacking Attacks

Attackers launch session hijacking attacks on unsecured HTTP communications. If session tokens are intercepted due to weak security measures, attackers can cause damage to the application’s infrastructure, intercept sensitive data, or gain access to other applications going unnoticed. Session hijackings are often difficult to detect, with cybercriminals lurking undetected until they intercept credentials or user information.

Process of Vulnerability Assessment

Vulnerability assessments are a critical part of web application safety and protection. They require a team of expert security analysts along with penetration testing tools that scan applications for vulnerabilities. A standard industry process for assessing application vulnerabilities is an ongoing cycle that includes configuration of tools, vulnerability testing, analysis of results, and remediation. For the most effective approach to detecting and remediating application vulnerabilities throughout production, the process of vulnerability assessments is best if repeated at different stages throughout development and production. Many recommend daily scans of applications for vulnerabilities.

Configuration of Vulnerability Assessment Tools

The first step in the process of vulnerability assessment is configuring vulnerability assessment tools. Configurations are based on known vulnerabilities via databases and in-depth analysis by security experts. The effectiveness of legacy scanning tools relies heavily on knowledge of the application’s infrastructure and the expertise of the analysts configuring them. With most scanning tools, improper configurations could lead to inaccurate results and hold up production times.

Execution of Vulnerability Scans

After configurations, scans are executed depending on the stage of production of the application. Early in production, static application security testing (SAST) tools are used to prevent holding up developers from coding. In deployment, dynamic application security testing (DAST) tools test the application’s response when vulnerabilities are triggered. Most of the time, both tools are used for a more aggressive approach to finding and preventing vulnerabilities before a potential exploit.

Analysis of Triggered Application Vulnerabilities

Both SAST and DAST require expert analysis of vulnerabilities, where security experts will analyze and rank triggered vulnerabilities and propose means of remediation. Every single vulnerability is listed in PDF form after a scan with SAST tools, each one taking one hour or more to investigate. After investigations and rankings, results are passed to developers who will find a means of remediation.

Remediation of Triggered Application Vulnerabilities

Once security teams are done with analysis, they pass their findings to developers to remediate. Once remediations are in place, the cycle begins again, where previous vulnerabilities are checked for effectiveness and new vulnerabilities are hunted down.

Legacy Vulnerability Assessment Tools Hold Up Production

Application development has reached record speeds thanks to open-source libraries and scalable infrastructures. Advancements in development require advancements in security, which is why legacy tools create a bottleneck. Vulnerability scanning takes hours to execute and even longer to remediate. These consume valuable development time and slow release cycles. In response, 55% of developers admit to skipping security scans to meet deadlines due to the challenges associated with legacy application security testing (AST) tools.

SAST and the False Positive

There are multiple reasons organizations choose SAST. One is the need to demonstrate compliance with industry standards and internal security policies. Another is the fact that SAST is a proven technology, in place in organizations for numerous years. However, legacy SAST solutions were not designed for the modern SDLC. Scan times are too long and require specialized resources. Remediation is difficult, as line-of-code guidance is missing and developers often waste valuable time searching for and diagnosing the cause of a vulnerability.

Because legacy SAST tools sit outside of the software, the piles of security alerts they generate often are chock full of false positives. Application security teams are directly impacted and spend hours triaging and diagnosing alerts that turn out to be false positives. With false positives taking longer than one hour to triage and diagnose and real vulnerabilities taking several hours to detect and another four hours to remediate, the amount of time incurred by legacy SAST tools is substantial.

DAST and the False Negative

DAST vulnerability scanning tools are incapable of detecting zero-day attacks and can only identify known threats. False negatives can pose serious risk and incur significantly more time to remediate—if and once they are found. Specifically, if found in production, finding the cause of a triggered vulnerability requires additional testing, which is time-consuming and can take an application offline. Even if the false-negative vulnerability was discovered in development, the time to remediate it can be significant. For example, 27% of developers say that they stop coding to remediate triggered vulnerabilities every single day. With more applications in development, this will only grow over time.

Improving Vulnerability Assessments With Pipeline-native Static Scanning

In a recent study, 61% of organizations admitted they experienced a successful application attack three or more times in the past year, and 72% of those attacks resulted in the loss of critical data. A different approach to application security is required, one that scales to the demands of the modern SDLC, one that eliminates the noise of false positives, and one that unleashes the full potential of DevOps and Agile.

Legacy application security embeds security outside of the software. Instead, application security must be instrumented and reside within the software and be pipeline native. Contrast Scan uses pipeline-native static analysis to analyze code in runtime, which accelerates scan times up to 10x and remediation time 45x while improving efficiency by 30%. Further, unlike legacy SAST tools that do not integrate into continuous integration/continuous deployment (CI/CD) and into the DevSecOps life cycle, Contrast Scan integrates into the CI/CD pipeline and the Contrast Application Security Platform.

Automated Vulnerability Assessments With IAST

As part of the Contrast Application Security Platform, Contrast Scan integrates with Contrast Assess interactive application security testing (IAST) that empowers developers to automatically detect and fix vulnerabilities while writing code. And as is the case with Contrast Scan, Contrast Assess virtually eliminates false positives.

Extending Security Protection and Observability Into Runtime

The Contrast Application Security Platform extends security within the software into production with Contrast Protect that delivers continuous runtime protection and observability. Contrast Protect detects attacks on vulnerabilities in real time and blocks them before they can successfully exploit the vulnerability. The information—including known and unknown threats—is shared within the Application Security Platform, enabling Contrast Scan, Contrast Assess, and Contrast OSS to pinpoint exploitable vulnerabilities in development and test environments. When a vulnerability is triggered, developers know the exact location for quick detection and faster remediation.

Like its Application Security Platform counterparts in development and test, Contrast Protect dramatically reduces the number of false positives—pinpointing only those vulnerabilities that pose a true risk.

Vulnerability Assessments Using a DevSecOps Platform Approach

Vulnerability assessments are a critical part of application security, and all organizations should adopt more aggressive approaches as the application attack surface expands. Instead of continuing the same cycle with a mix of outdated tools, it’s best to incorporate application security measures that integrate with development environments and empower developers to find and fix vulnerabilities when they are introduced. In addition, new approaches such as pipeline-native static analysis must replace legacy models that employ outside-in security. Finally, a comprehensive DevSecOps platform approach that integrates all elements of application security—development, test, and production—into one interface can generate significant improvements, helping to scale application security while unleashing the full potential of DevOps and Agile.

Suggested Content

[Report]: The State of DecSecOps Report

[Whitepaper]: How Legacy Application Security Requires Experts, Time, and Cost That Degrades DevOps Efficiencies

[eBook]: How Manual Application Vulnerability Management Delays Innovation and Increases Business Risk