What Healthcare Can Teach Us About Application Security

January 15, 2014 - Here’s our challenge: our increasing reliance on software is occurring exactly when two other trends are making security more difficult. First, software size, complexity, interconnection, and even development speed are increasing rapidly. Second, advances in software technology are rapidly making traditional security scanners and code analyzers obsolete. Seriously… this won’t end well.

Poor visibility is poor security
Most organizations, even those with "mature" application security programs, have terrible visibility into the security of their application portfolios. They might be tracking some risks from penetration tests or automated scans. They might have a spotty application and component inventory. But when you get right down to it, they probably have very little real evidence that their defenses are correct and properly used across their application portfolios. And the information that they have gathered is so far out of date that it is of little use to development projects.

Ironically, the biggest risk in a risk assessment report isn’t even captured in its pages: the risk that the assessment itself has missed something important. Typical risk assessments don’t capture all the details about what code was covered, which defenses were checked, and what tests were performed. So, for example, if an assessment doesn’t cover authentication or access control (most don’t), the report reveals nothing, and the development team is left with a very dangerous false sense of security.

With a little tweaking and some perspective, we can transform techniques like dynamic scanning, static analysis, penetration testing, code review, architecture review, and threat modeling to generate a lot of assurance.

Battling the flu with instrumentation
We can learn a lot from the world of healthcare. Did you know the mission of the Centers for Disease Control (CDC) is to protect people from “health threats” and increase the “health security” of our nation? Its mission is not as different from information technology security as you might think.

The CDC fights disease, but they’re not your typical doctors. The size and complexity of their problem forces them to use very different techniques -- techniques that scale. The CDC is using sensors and instrumentation to gather data from people, doctors, hospitals, and labs at scale. It's now monitoring more than 700,000 flu patients every week.

The CDC uses this sensor data to combat influenza. The chart below shows that this year’s flu is peaking at a similar time but is less intense than in last years. Researchers are using this data to identify strains with more accuracy and create better defenses (flu shots) to protect people.

Source: Google.org flu trends.

As application security challenges continue to mount, we can take advantage of sensors and instrumentation to increase visibility and create assurance. Imagine new sensors that track security-critical information across your entire application portfolio in real time. Below is a snapshot of a real-time software assurance dashboard generated from a small organization’s application portfolio:

Using Sensors & Instrumentation for Application Security Visibility

Each of the expected defenses represents one part of a more detailed security story. The dashboard illustrates the level of assurance for each of the expected security defenses in each application. Sampling and circumstantial evidence can be used at the lower levels, but the higher levels require more rigorous verification.

New sensor technology can gather this information directly from applications in development, test, integration, and even production. Traditional application security tools, both static and dynamic, can be retooled to generate this kind of evidence. For example, tools like OWASP’s ZAP proxy can be used to identify vulnerabilities, but can also be set up as a passive sensor. A simple ZEST script can generate continuous evidence that Cross-Site Request Forgery (CSRF) token defenses are working across an entire application portfolio.

Focusing your application security program on generating portfolio assurance has many benefits. You can learn more about this approach in my recent OWASP talk, Application Security at DevOps Speed and Portfolio Scale. This approach is far more compatible with Agile and DevOps style development than the traditional annual security test. But more importantly, it actually produces security and increases the health of your application security program.