Taking on Security Automation

Taking on Security Automation

Increasing risk exposure in modern software

Security experts are sounding the alarm about risks in the software development process. Not only does modern software architecture create a broader attack surface area, the accelerated DevOps methodology makes it harder to detect and remediate vulnerabilities. The heart of this issue is that DevOps teams are challenged to take on new security responsibilities. This is not a role they are trained to play, but it is possible to make developers an extension of your security strategy. New tools for automated security in DevOps remove much of the security burden placed on developers—but do so in ways that make them part of the solution at the same time, while not slowing development.

DevOps as a Driver of Increasing Risk Exposure in Modern Software

DevOps teams offer much to businesses who employ it. Assuming you can pull off the tricky integration between two different and organizationally-distinct groups, the result is faster software development cycles and alignment with agile methodologies. Combined with practices such as Continuous Integration and Continuous Deployment (CI/CD), DevOps enables the release of new software features at a rapid clip.

This is great until you start to look at DevOps from the perspective of information security. The pace of development is simply too fast for traditional application security techniques to work. According to SANS Institute research, 43 percent of organizations are pushing out changes to their software either daily, weekly or continuously. Historically, software testing was intended to reveal security flaws in a new application. There is little time built for manual AppSec inspection into these processes on today’s rapid DevOps timetable.

The nature of software vulnerability is also evolving, making code developed using DevOps that much more vulnerable. Undetected at the source, hackers can plant malware into the vast open source code libraries that DevOps teams draw on for their work. This is an astonishing 79 percent of code. Now, those libraries can carry malicious code.

The Fallacy of Expecting Developers to Enforce Security Policies

Development professionals already have a full-time job: writing great code. Their skill sets revolve around code. They get paid to write code and fix bugs. Bonuses are based on writing code to deliver new products and features that popularize applications. They are used to having an arm’s-length relationship with security. Developers care about security if, and when, it helps to make their products better, faster and more reliable. However, if a vulnerability seems theoretical, or worse the issue is a security “code hygiene” practice, then developers may not give that type of security escalation much priority.

A new approach today involves continuous follow up with dynamic, run-time analysis that can uncover real security problems. Done right, automated analysis identifies critical issues with a clear path to remediation. Once a problem is uncovered, the developer can address it as a software “bug,” e.g. JIRA ticket that includes secure code samples and recommendations to make the remediation straightforward.

The need for automated security discovery without the burden of being trained as a security professional is crucial. It is possible to make DevOps more secure. Armed with this automation, developers will be able to test for vulnerabilities sooner in the development process instead of at the end or after there is a huge breach and they have to rebuild, rewrite code or find a new job anyway.

This article originally appeared in the November/December 2019 issue of Security Today.

About the Author

Felicia Haggarty is a director at Data Theorem.

Featured

  • 12 Commercial Crime Sites to Do Your Research

    12 Commercial Crime Sites to Do Your Research

    Understanding crime statistics in your industry and area is crucial for making important decisions about your security budget. With so much information out there, how can you know which statistics to trust? Read Now

  • Boosting Safety and Efficiency

    Boosting Safety and Efficiency

    In alignment with the state of Mississippi’s mission of “Empowering Mississippi citizens to stay connected and engaged with their government,” Salient's CompleteView VMS is being installed throughout more than 150 state boards, commissions and agencies in order to ensure safety for thousands of constituents who access state services daily. Read Now

  • Live From GSX: Post-Show Review

    Live From GSX: Post-Show Review

    This year’s Live From GSX program was a rousing success! Again, we’d like to thank our partners, and IPVideo, for working with us and letting us broadcast their solutions to the industry. You can follow our Live From GSX 2023 page to keep up with post-show developments and announcements. And if you’re interested in working with us in 2024, please don’t hesitate to ask about our Live From programs for ISC West in March or next year’s GSX. Read Now

    • Industry Events
    • GSX
  • People Say the Funniest Things

    People Say the Funniest Things

    By all accounts, GSX version 2023 was completely successful. Apparently, there were plenty of mix-ups with the airlines and getting aircraft from the East Coast into Big D. I am all ears when I am in a gathering of people. You never know when a nugget of information might flip out. Read Now

    • Industry Events
    • GSX

Featured Cybersecurity

Webinars

New Products

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions. 3

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings. 3

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles. 3