Application Security (AppSec)

Application Security (AppSec)

Oct 27th 2021

 

Implementing application security (AppSec) from the beginning

There is a movement in the IT security world that is gaining traction, and it is based around the implementation of security within applications from the beginning. You may have heard buzzwords like “AppSec”, “DevSecOps” and “Shift Left”, but what do they actually mean? What does it take to “Shift Left” when developing a secure application? You can read about dealing with dependencies in our blog post.

In this article, we will explore how implementing security testing and controls earlier on in an application’s Software Development Life Cycle (SDLC) can impact a business. We will also discuss the ways a traditional application assessment may bring to light bigger issues than just insecure code, as well as the differences between the remediation performance of any potential vulnerabilities.

Using SQL injection as an example, even though injection has slipped in the OWASP Top 10 this year, injection attacks are still prevalent and common during application tests. Consider that an application has been fully developed in the ‘traditional’ method; no security assessments were performed at the beginning (threat modelling) or during (secure code reviews). Then, before the application is put into production, a security assessment is required for assurance purposes.

The scenario

Consider a scenario where a software development company contacts us for an application assessment. The application consists of a bootstrap frontend. There is a search form for querying critical business information, such as customer order details from an online retailer. The frontend end is supported by an API, which queries the business-critical database.

During the application assessment, a consultant identifies a potential SQL injection vulnerability in the search functionality with an apostrophe (‘). A database syntax error is returned. 

There are many actions we could perform at this point. However, we only need to validate the weakness, for which a sleep command will suffice. Once the vulnerability is confirmed, a call is made to the relevant security contact and we discuss in-depth the vulnerability that we have identified and our recommendations to remediate this.

What next?

The consultant continues the application assessment in the hunt for more vulnerabilities, but the client now has a situation on their hands. An application has been developed to the point of release and all of a sudden, a significant security issue is identified.

This causes a number of challenges. Do the developers action the finding, mitigate the issue by ensuring database queries are parameterised and user input is sanitised, and accept that there are no longer any bugs in the code? Or, should they perform a full code review to supplement the application assessment with a further level of assurance?

Consider that the application does not solely support searching for customer orders. It likely supports queries for searching for items, quantities, sizes and colours; which may all support additional filters such as ordering or grouping. All of which may provide an opportunity for a malicious actor to achieve SQL injection.

There may be thousands of lines of code to analyse and check for entry points and insecurely written database queries. This takes a significant amount of time and often results in development teams missing deadlines and overspending on this remediation activity. 

Shift Left, DevSecOps?

This is why Shift Left and DevSecOps (or SecDevOps) have come into the spotlight. The industry wants to build secure applications from the ground up which eliminates the need for the above remediation activities. 

This may consist of threat-modelling prior to any code being written. A detailed plan of the application structure, its processes, inputs and outputs, and authentication mechanisms is used to identify where weaknesses may be found in the development stage. 

Developers may be trained to write secure code or given access to tooling that will help to identify and explain potential vulnerabilities. There are tools available that analyse code or can be implemented into DevOps pipelines that automatically check for vulnerabilities and provide detailed information, prior to being accepted and merged into the codebase.

Final thought

Shift Left and DevSecOps are not going to happen overnight and are not a responsibility that relies solely on the development team. The shift has to be adopted by the entire organisation and support should be given to the development team by offering expertise and tooling. Collaboration between security teams and development teams should be encouraged.

There should not be a compromise between rapid development cycles and best practice security. When an organisation adopts security early on, both can be achieved. This will improve security posture and reduce costs of security integration while maintaining fast delivery which ultimately leads to business success.

Path traversal bug in Grafana: Preventable mistake or an important lesson?

Path traversal bug in Grafana: Preventable mistak...

Exchange-Exploit

New Exchange RCE vulnerability actively exploited

How effective is secure code review for discovering vulnerabilities?

How effective is secure code review for discoveri...

Dealing with Dependencies

Enhancing Security in your Software Development L...

Exchange Server Emergency Mitigation Service

Exchange Server Emergency Mitigation Service

VMware

VMware vCenter Critical RCE Vulnerability

OWASP

OWASP Top 10 2021 Released

Introduction to Windows 11 (Beta) Security

Introduction to Windows 11 (Beta) Security

HTTP/3 and QUIC: A new era of speed and security

HTTP/3 and QUIC: A new era of speed and security?

Microsoft reports open redirection phishing tactic

Microsoft reports open redirection phishing tactics

Fortinet WAF allows remote code execution

Fortinet WAF allows remote code execution

Microsoft Exchange Bugs

Microsoft Exchange Proxy Vulnerabilities

PetitPotam: Windows AD CS NTLM Relay Attack

PetitPotam: Windows AD CS NTLM Relay Attack

What to do after your penetration testing report

What should you do after your penetration testin...

What is penetration testing and why is it important to use a CREST-approved provider?

What is penetration testing and why is it importa...

How to prepare your business for secure cloud migration

How to prepare your business for secure cloud mig...

How secure use of the cloud can transform your business

How secure use of the cloud can digitally transfo...

What is crest and how does it benefit you?

What is CREST and what are the benefits of using ...

How can the 10 steps to cyber security help to protect your organisation?

How can the 10 steps to cyber security help to pr...

The importance of cyber security

Celebrating Sentrium’s contribution to cyber secu...

What is OWASP Application Security

What is OWASP application security?

Pentration testing report

What should you do after your penetration testing...

Protect against a phishing attack

How to protect against a phishing attack

Secure data in cloud computing

How to secure data in cloud computing

The Security risks of cloud computing

What are the security risks of cloud computing?

Maintain security when employees work remotely

How to maintain security when employees work remo...

Identify and avoid phishing attacks

How to identify and avoid phishing attacks

Penetration testing

What is penetration testing and why is it important?
  • Left Arrow Icon
  • Right Arrow Icon