Taking on Security Automation

Taking on Security Automation

Increasing risk exposure in modern software

Security experts are sounding the alarm about risks in the software development process. Not only does modern software architecture create a broader attack surface area, the accelerated DevOps methodology makes it harder to detect and remediate vulnerabilities. The heart of this issue is that DevOps teams are challenged to take on new security responsibilities. This is not a role they are trained to play, but it is possible to make developers an extension of your security strategy. New tools for automated security in DevOps remove much of the security burden placed on developers—but do so in ways that make them part of the solution at the same time, while not slowing development.

DevOps as a Driver of Increasing Risk Exposure in Modern Software

DevOps teams offer much to businesses who employ it. Assuming you can pull off the tricky integration between two different and organizationally-distinct groups, the result is faster software development cycles and alignment with agile methodologies. Combined with practices such as Continuous Integration and Continuous Deployment (CI/CD), DevOps enables the release of new software features at a rapid clip.

This is great until you start to look at DevOps from the perspective of information security. The pace of development is simply too fast for traditional application security techniques to work. According to SANS Institute research, 43 percent of organizations are pushing out changes to their software either daily, weekly or continuously. Historically, software testing was intended to reveal security flaws in a new application. There is little time built for manual AppSec inspection into these processes on today’s rapid DevOps timetable.

The nature of software vulnerability is also evolving, making code developed using DevOps that much more vulnerable. Undetected at the source, hackers can plant malware into the vast open source code libraries that DevOps teams draw on for their work. This is an astonishing 79 percent of code. Now, those libraries can carry malicious code.

The Fallacy of Expecting Developers to Enforce Security Policies

Development professionals already have a full-time job: writing great code. Their skill sets revolve around code. They get paid to write code and fix bugs. Bonuses are based on writing code to deliver new products and features that popularize applications. They are used to having an arm’s-length relationship with security. Developers care about security if, and when, it helps to make their products better, faster and more reliable. However, if a vulnerability seems theoretical, or worse the issue is a security “code hygiene” practice, then developers may not give that type of security escalation much priority.

A new approach today involves continuous follow up with dynamic, run-time analysis that can uncover real security problems. Done right, automated analysis identifies critical issues with a clear path to remediation. Once a problem is uncovered, the developer can address it as a software “bug,” e.g. JIRA ticket that includes secure code samples and recommendations to make the remediation straightforward.

The need for automated security discovery without the burden of being trained as a security professional is crucial. It is possible to make DevOps more secure. Armed with this automation, developers will be able to test for vulnerabilities sooner in the development process instead of at the end or after there is a huge breach and they have to rebuild, rewrite code or find a new job anyway.

This article originally appeared in the November/December 2019 issue of Security Today.

About the Author

Felicia Haggarty is a director at Data Theorem.

Featured

  • Allegion, Comfort Technologies Implement Mobile Credentials at the Artisan Apartment Homes in Florida

    Artisan Apartment Homes, a luxury apartment complex in Dunedin, Florida, recently transitioned from mechanical keys to electronic locks and centralized system software with support from Allegion US, a leading provider of security solutions, technology and services, and Florida-based Comfort Technologies, which specializes in deploying multifamily access control, IoT devices and software management solutions. Read Now

  • Mall of America Deploys AI-Powered Analytics to Enhance Parking Intelligence

    Mall of America®, the largest shopping and entertainment complex in North America, announced an expansion of its ongoing partnership with Axis Communications to deploy cutting-edge car-counting video analytics across more than a dozen locations. With this expansion, Mall of America (MOA) has boosted operational efficiency, improved safety and security, and enabled more informed decision-making around employee scheduling and streamlining transportation for large events. Read Now

  • Security Industry Association Launches New “askSIA” AI Tool

    The Security Industry Association (SIA) has unveiled a brand-new SIA member benefit – askSIA, a conversational AI agent designed to help users get the most out of their SIA membership, easily access SIA resources and find the latest information on SIA’s training and courses, reports and publications, events, certification offerings and more. SIA members can easily find askSIA by visiting the SIA homepage or looking for the askSIA icon in the top left of webpages. Read Now

    • Industry Events
  • Industry Embraces Mobile Access, Biometrics and AI

    A combination of evolving workplace dynamics, technology innovation and new user expectations is changing how people enter and interact with physical spaces. Access control is at the heart of these changes. Combined with biometrics and AI, mobile access control has become increasingly crucial for deploying entry solutions that are seamless, secure and adaptive to user needs. Read Now

  • Sustainable Video Solution Delivered for Landmark City of London Office Development

    An advanced, end-to-end video solution from IDIS, with a focus on reducing waste and costs, has helped a major office development in the City of London align its security with sustainability objectives. Read Now

New Products

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file.