Page 29 - Security Today, November/December 2019

SOFTWARE DEVELOPMENT
TAKING ON SECURITY AUTOMATION Increasing risk exposure in modern software
By Felicia Haggarty
“The need for auto- mated security discov- ery without the burden of being trained as a security professional is crucial.”
Security experts are sounding the alarm about risks in the software development process. Not only does modern software architecture create a broader attack sur- face area, the accelerated DevOps meth- odology makes it harder to detect and remediate vulnerabilities. The heart of this issue is that DevOps teams are chal- lenged to take on new security responsi- bilities. This is not a role they are trained to play, but it is possible to make develop- ers an extension of your security strategy. New tools for automated security in De- vOps remove much of the security burden placed on developers—but do so in ways that make them part of the solution at the same time, while not slowing development.
DevOps as a Driver of Increasing Risk Exposure in Modern Software
DevOps teams offer much to businesses who employ it. Assuming you can pull off the tricky integration between two different and organizationally-distinct groups, the result is faster software development cycles and alignment with agile methodologies. Combined with practices such as Continu- ous Integration and Continuous Deploy- ment (CI/CD), DevOps enables the release of new software features at a rapid clip.
This is great until you start to look at DevOps from the perspective of informa- tion security. The pace of development is simply too fast for traditional application security techniques to work. According to SANS Institute research, 43 percent of organizationsarepushingoutchangesto their software either daily, weekly or con- tinuously. Historically, software testing was intended to reveal security flaws in a new
application. There is little time built for manual AppSec inspection into these pro- cesses on today’s rapid DevOps timetable.
The nature of software vulnerability is also evolving, making code developed us- ing DevOps that much more vulnerable. Undetected at the source, hackers can plant malware into the vast open source code libraries that DevOps teams draw on for their work. This is an astonishing 79 percent of code. Now, those libraries can carry malicious code.
The Fallacy of Expecting Developers to Enforce Security Policies
Development professionals already have a full-time job: writing great code. Their skill sets revolve around code. They get paid to write code and fix bugs. Bonuses are based on writing code to deliver new products and features that popularize applications. They are used to having an arm’s-length relationship with security. Developers care about security if, and when, it helps to make their products better, faster and more reliable. However, if a vulnerability
seems theoretical, or worse the issue is a security “code hygiene” practice, then de- velopers may not give that type of security escalation much priority.
A new approach today involves con- tinuous follow up with dynamic, run-time analysis that can uncover real security problems. Done right, automated analysis identifies critical issues with a clear path to remediation. Once a problem is uncovered, the developer can address it as a software “bug,” e.g. JIRA ticket that includes se- cure code samples and recommendations to make the remediation straightforward.
The need for automated security dis- covery without the burden of being trained as a security professional is crucial. It is possible to make DevOps more secure. Armed with this automation, developers will be able to test for vulnerabilities soon- er in the development process instead of at the end or after there is a huge breach and they have to rebuild, rewrite code or find a new job anyway.
Felicia Haggarty is a director at Data Theorem.
WWW.SECURITYTODAY.COM NS3