As we can read in various research papers, exploitable vulnerabilities in applications remain a top cause of external breaches. Due to the pandemic, applications often became the only way to engage with customers, which has exacerbated the problem.

To increase the security posture of your application portfolio you should have a robust Application Security (AppSec) program in place. Making sure everybody in your organization knows what needs to be done, the basis of your AppSec Program should be an easy-to-understand and accessible AppSec Policy.

In this blog post, I will speak about the minimum that needs to be in an AppSec policy. But before going into that, you have to understand your AppSec policy needs to be updated on a regular basis, based on the trends in the software development industry:

• There is an increase in the number of applications and releases.
• This increase is fueled by the increased usage of open source and commercial code.
• To increase the agility and flexibility of the different applications, and to leverage their functionality, there is an increase in the use of APIs.
• To reach more customers and make it easier to do business with you, there is an increase in the number of application types (web, mobile, social media, and cloud).
• To be able to deal with the elasticity in demand for your applications, while reducing the TCO, there is an increase in the utilization of containers (The lack of secure container configurations provides another attack vector for your applications).

As we all know, fixing AppSec issues early on in the software development lifecycle (SDLC) is more cost-effective in comparison to fixing them in test (10x) or production (30x). As a result, the responsibility for AppSec is moving from a separate AppSec team to the development teams. This shift has an additional impact on your AppSec policy:

• Place the responsibility for AppSec in the hands of the developers. Also known as shift left or developer-driven AppSec.
• To minimize the impact on the developers’ day-to-day activity, build AppSec into their DevOps pipeline.
• To reduce time to prioritize vulnerabilities to remediate, aggregate scan results from different technologies.
• To increase the AppSec during deployment, build securing container configurations into the DevOps pipeline.
• To bridge the gap between development and security, create/improve a program to build developer security champions.
• AppSec should be enabler and not an inhibitor by slowing down or even prevent releases.

Based on the aforementioned trends and observations, at a minimum, the following has to be updated/added in your AppSec policy:

1. Access Control

   1. API:

      1. Use tokens: Establish trusted identities and then control access to services and resources by using tokens assigned to those identities.
      2. Use encryption and signatures: Encrypt your data using a method like TLS (see above). Require signatures to ensure that the right users are decrypting and modifying your data, and no one else.
      3. Use quotas and throttling: Place quotas on how often your API can be called and track its use over history. More calls on an API may indicate that it is being abused. It could also be a programming mistake such as calling the API in an endless loop. Make rules for throttling to protect your APIs from spikes and Denial-of-Service attacks.
      4. Use an API gateway: API gateways act as the major point of enforcement for API traffic. A good gateway will allow you to authenticate traffic as well as control and analyze how your APIs are used.

2. Vulnerability Identification:

   1. Responsibility:

      1. The development teams are responsible for the identification, prioritization, and remediation of vulnerabilities in their developed source code and utilized open source and commercial code.

   2. Static Application Security Testing (SAST):

      1. Changes in- or the addition of- all open source, commercial code, and APIs will undergo SAST and will have no critical or high vulnerabilities before released into the TEST environment.
      2. All SAST will be seamlessly integrated into the existing CI/CD pipeline, without the need for the development to install new products/tools into their existing tool set.

   3. Integrated Application Security Testing (IAST):

      1. Changes in- or the addition of- all open source, commercial code, and APIs will undergo IAST and will have no critical or high vulnerabilities before released into the User Acceptance Test (UAT) environment.
      2. All IAST will be seamlessly integrated into the existing CI/CD pipeline, without the need for the development to install new products/tools into their existing tool set.

   4. Mobile Application Security Testing (MAST):

      1. All mobile applications will undergo MAST and will have no critical or high vulnerabilities before released into the User Acceptance Test (UAT) environment.
      2. All MAST will be seamlessly integrated into the existing CI/CD pipeline, without the need for the development to install new products/tools into their existing tool set.

3. Configuration Management:

   1. Cloud:

      1. Every AWS instance on which (part of) any application runs will be configured securely, using the latest version of securing AWS configuration guideline as part of the existing CI/CD pipeline.

   2. Containerization:

      1. Every Docker instance on which (part of) any application runs will be configured securely, using the latest version of securing Docker configuration guideline as part of the existing CI/CD pipeline.

4. Training and Education:

   1. Every development team will have at least one (1) certified Security Champion program within three months after identification. The Global Internal Education team is responsible for the training and certification of this person.

The importance of AppSec is becoming more apparent as time goes on with leaders of industries experiencing the cost of having a product with vulnerabilities. Taking these steps towards your AppSec Policies will set a strong foundation that will allow your developers to work more effectively while also upholding a higher standard of quality for your application.

Article: https://www.linkedin.com/pulse/update-your-appsec-policy-based-current-trends-percy-rotteveel