MATURITY MATTERS

Software plays a central role in business processes and in our daily lives, and companies of all sizes and industries are building, buying, and downloading more applications than ever before. However, this increased dependence on software makes the applications powering our world a prime target for cybercriminals. Applications are the No. 1 attack vector for cybercriminals and the main source of breaches.

In addition, the way software is developed is changing. Contemporary application development methodologies like DevOps are increasing the speed and precision with which software is produced and deployed. The increased speed and precision have created a modern software factory akin to the manufacturing factories of past industrial revolutions.

And like past industrial revolutions and manufacturing-based economies, the application economy depends on high-quality and secure products (applications) in order to thrive. The speed and scope of software development in organizations, coupled with other evolutions in how software is made, such as the use of open source and third-party components, are creating new challenges in ensuring the security of software.

A different approach to application security (AppSec) — one that aligns with the new role of software and today’s development paradigms — is now key to effective information security.

And that approach entails an AppSec program that both integrates security seamlessly into developer processes, and that is a comprehensive, mature, ongoing program — rather than a one-off project. Why? Because these programs get results. Research for our annual State of Software Security report found that organizations with long-standing, comprehensive AppSec programs had a 35 percent better OWASP pass rate than programs in place for less than a year.

Unfortunately, application security is frequently misunderstood. Too often, business and security leaders don't know how or where to begin, or they lack the technology framework to fully execute on a plan. As a result, they rely on an approach that delivers subpar results.

We typically find that organizations are at one of four maturity stages in addressing application security. Those four stages are: a reactive approach, which relies on ad hoc tools and security assessments that reside outside the development lifecycle; a baseline approach that depends on assessments at the end of the software development lifecycle (SDLC); an expanded approach that begins to integrate tools at various stages but often lags behind the required pace; and an advanced approach that manages application security in a more holistic and integrated way.

Regardless of which stage you’re currently in, however, your goal should be to move toward a mature, comprehensive program, which is ultimately the most effective way to protect your application layer.

A TALE OF FOUR STAGES

Here's a more detailed look at the four stages of application security maturity and how they impact your overall security framework:

Reactive.

Organizations that fall into this group typically find themselves driven by broad security requirements, including government regulations, industry compliance or customer demands. The problem with constantly responding to specific needs and requirements is that application security winds up revolving around manual penetration testing and other reactive methods. Unfortunately, this method devours money and staff time.

What's more, if your organization doesn't respond effectively to every threat — and many of them will unfold without warning — your enterprise faces a greater risk of a breakdown. This could lead to reputational damage or the direct loss of sales. A reactive approach is often slow, it doesn't scale effectively, and it lacks the automation and integration that's required for digital-age software development and business. At this level, most organizations also lack centralized governance and reporting and lag in developer involvement and education.

• Learn more about your next steps if you're in the reactive stage.

---

Baseline.

This approach takes aim at a wider array of application security functions, though it most often centers on business-critical applications. The most common techniques associated with a baseline approach are manual penetration testing and dynamic analysis (DAST).

Although a baseline approach boosts integration and automation, it becomes increasingly challenging as an enterprise moves to Agile and DevOps. With this approach, most security assessments take place toward the end of the software development lifecycle (SDLC). As a result, flaws are more expensive and difficult to fix — in some cases requiring 10 times more money and resources. The end result is a process that’s often slow, inflexible, and unscalable.

• Learn more about your next steps if you're in the baseline stage.

---

Expanded.

As organizations improve their processes and technology, they wind up adopting an expanded approach. This approach embeds some level of automation into application security across the SDLC. The tools used at this stage include static and dynamic analysis, along with manual penetration testing. The goal is to deliver the services and support developers require to generate, maintain, and fix code.

An expanded approach is among the most common methods used today. However, it, too, creates friction because an expanded approach still doesn't address fundamental challenges like scale, speed, and costs. It also lags in development involvement and education. Once again, as organizations move to Agile and DevOps, the deficiencies associated with this approach become more glaring.

• Learn more about your next steps if you're in the expanded stage.

---

Advanced.

The goal for an organization should be, over time, to reach the final stage — an advanced approach. As the name implies, this approach encompasses a more comprehensive framework for application security. The methodology aims to protect all code and applications — from those developed internally to those made up primarily of open source components — and across application lifecycles, from development to QA to production. Notably, in this stage, developers own the testing and fixing of security-related defects in code. Security testing is integrated into their existing tools and processes, leaving the security team to focus on more strategic endeavors like policy and training. Not only does this lead to a more cost-effective model, it delivers significantly better protection.

• Get a more detailed picture of what an advanced application security program looks like.

EMBRACING MATURITY

A mature application security program might seem intimidating to some organizations. But it’s important to remember that there is an established series of steps most organizations take when developing an application security program. The keys are to start small, keep things simple, prove the value, and then mature the program over time. In fact, the most successful companies we’ve worked with have started by securing a few apps at a time. In addition, if you build security assessments into the development process, reaching maturity is less daunting. The journey to a more advanced application security framework and a more mature approach to security starts with a few key steps:

Defining the policy and the program.

With a thorough understanding of all the various components of your application security program, it's possible to develop clear and relevant policies and procedures. Even with code scans and various other tools in place, it's important to have processes that ensure your organization is adhering to regulatory controls, industry standards, and internal policies. Ensuring that teams are synced and that different groups within your organization are communicating and collaborating effectively, is paramount. A mature application security program incorporates clear policies and guidelines — and has the mechanisms in place to make sure people follow them.

EXECUTION IS EVERYTHING

Although planning and analysis are crucial to developing a mature application security framework, there's also the challenge of executing on the plan. This translates into engaging the development team and putting a remediation effort into motion, incorporating advanced testing methods and tracking on key metrics. All of these things can’t happen without a coordinated effort. The goal is to boost the level of application security in your organizations without introducing steps and procedures that slow down software development, particularly in a fast-moving DevOps environment.

Today, success requires a deep understanding of development workflows and processes — and an ability to integrate them into the fabric of your business. This, in turn, requires teams to follow guidelines, standards, and protocols. However, a team can also create friction and block progress if not everyone understands the value of the plan or has the tools to integrate application security into development processes on a daily basis. For instance, developers must know what to do with scanning results, how to avoid introducing the same vulnerabilities in the future, and how to promptly fix code without slowing down work.

When an enterprise sets the bar at the appropriate level and makes results achievable, it's possible for developers and security teams to hit the sweet spot on the performance-protection continuum. Ideally, every policy should revolve around this concept. It's the foundation of an effective AppSec program.

TECHNOLOGY ISN'T
AN AFTERTHOUGHT

A more sophisticated approach to application security also requires the right combination of tools and technologies. As a rule, multiple testing techniques are more effective than a single, blunt-force method. A multi-dimensional framework also helps spot different types of vulnerabilities that might otherwise go undetected. For example, research indicates that there are differences in the types of vulnerabilities discovered by examining applications dynamically at runtime, as compared to doing static tests in a non-runtime environment.

In order to achieve an inception-to-production view — essentially a complete SDLC approach — it's important to not only rely on a mix of static, dynamic, and manual testing, but also on tools that allow developers to test code early and frequently. This includes tools such as Veracode Static Analysis, which brings security scanning into the IDE while providing immediate feedback.