Managing Application Security in Large Organizations: Insights and Best Practices
M
A
N
A
G
I
N
G
A
P
P
L
I
C
A
T
I
O
N
S
E
C
U
R
I
T
Y
2017 Application
Security Survey
by Security Compass
PRESENTED AT:
APRIL 27, 2017
Altaz Valani
Director of Research
T: @altazvalani
LI:
linkedin.com/in/altazvalani
P
E
R
S
O
N
A
L
B
I
O
MANAGING APPLICATION SECURITY
PAGE 2
Previously:
•
Senior Research Director, Application Development at Info-Tech Research Group
•
Senior Manager, KPMG
•
Started a software development company
Interests:
•
Secure software development
•
Teaching and learning
•
Research and collaboration
P
U
R
P
O
S
E
To discover how large, complex organizations
manage application security: the drivers,
programs, and successes.
W
H
O
Most respondents were large multinational
companies earning >$1 billion USD.
T
H
E
R
E
S
U
L
T
Aggregated insights, industry trends, and best
practices that illuminate how large
corporations manage application security.
A
B
O
U
T
T
H
E
S
U
R
V
E
Y
MANAGING APPLICATION SECURITY
PAGE 3
S
e
c
u
r
i
t
y
C
o
m
p
a
s
s
(
n
=
2
8
)
S
U
R
V
E
Y
D
E
M
O
G
R
A
P
H
I
C
(
B
Y
A
N
N
U
A
L
E
A
R
N
I
N
G
S
)
K
E
Y
R
E
S
E
A
R
C
H
F
I
N
D
I
N
G
S
B
U
S
I
N
E
S
S
P
R
E
S
S
U
R
E
I
S
N
O
T
G
O
I
N
G
A
W
A
Y
I
N
C
R
E
A
S
I
N
G
S
P
E
E
D
O
F
B
U
S
I
N
E
S
S
I
N
C
R
E
A
S
I
N
G
S
O
P
H
I
S
T
I
C
A
T
I
O
N
O
F
R
I
S
K
M
A
N
A
G
E
M
E
N
T
I
N
C
R
E
A
S
I
N
G
P
R
E
S
S
U
R
E
O
N
C
O
S
T
C
O
N
T
R
O
L
MANAGING APPLICATION SECURITY
PAGE 5
W
H
A
T
I
S
D
R
I
V
I
N
G
A
P
P
L
I
C
A
T
I
O
N
S
E
C
U
R
I
T
Y
?
7
9
%
of respondents stated
that general risk
management was the
key driver for their
organization's
application security.
MANAGING APPLICATION SECURITY
PAGE 6
S
e
c
u
r
i
t
y
C
o
m
p
a
s
s
(
n
=
2
8
)
C
O
N
C
L
U
S
I
O
N
:
W
E
N
E
E
D
A
S
Y
S
T
E
M
A
T
I
C
W
A
Y
O
F
M
A
N
A
G
I
N
G
A
P
P
L
I
C
A
T
I
O
N
S
E
C
U
R
I
T
Y
R
I
S
K
7
9
%
of respondents stated
that general risk
management was the
key driver for their
organization's
application security.
MANAGING APPLICATION SECURITY
PAGE 7
RISK
SOFTWARE PROJECT PROGRESS
IDENTIFY
CONTROL
IMPLEMENT
CONTROL
VALIDATE
CONTROL
H
O
W
I
M
P
O
R
T
A
N
T
I
S
A
P
P
L
I
C
A
T
I
O
N
S
E
C
U
R
I
T
Y
?
7
3
%
of respondents stated
that application security
is a high or critical
priority within their
organization.
MANAGING APPLICATION SECURITY
PAGE 8
S
e
c
u
r
i
t
y
C
o
m
p
a
s
s
(
n
=
2
6
)
O
R
G
A
N
I
Z
A
T
I
O
N
A
L
S
U
P
P
O
R
T
F
O
R
A
P
P
L
I
C
A
T
I
O
N
S
E
C
U
R
I
T
Y
(
B
Y
I
N
D
U
S
T
R
Y
)
MANAGING APPLICATION SECURITY
PAGE 9
1
=
N
O
S
U
P
P
O
R
T
5
=
S
U
P
P
O
R
T
A
C
R
O
S
S
T
H
E
B
O
A
R
D
S
e
c
u
r
i
t
y
C
o
m
p
a
s
s
(
n
=
2
1
)
A
D
O
P
T
I
O
N
O
F
S
E
C
U
R
I
T
Y
A
W
A
R
E
N
E
S
S
T
R
A
I
N
I
N
G
B
Y
D
E
V
E
L
O
P
E
R
S
MANAGING APPLICATION SECURITY
PAGE 10
1
=
N
O
T
R
A
I
N
I
N
G
5
=
A
L
L
D
E
V
E
L
O
P
E
R
S
A
R
E
T
R
A
I
N
E
D
S
e
c
u
r
i
t
y
C
o
m
p
a
s
s
(
n
=
2
2
)
There is resistance to
adoption of security
awareness training.
Many see this as extra
work, getting in the way
of releasing software.
T
R
A
C
K
I
N
G
T
H
E
E
F
F
E
C
T
I
V
E
N
E
S
S
O
F
A
N
A
P
P
L
I
C
A
T
I
O
N
S
E
C
U
R
I
T
Y
P
R
O
G
R
A
M
7
5
%
of respondents stated that the number of vulnerabilities
found was a key metric used to track the effectiveness
of their application security program.
O
N
L
Y
4
%
of respondents stated that they used the amount of
money spent on remediating vulnerabilities as a key
metric to track the effectiveness of their application
security program.
MANAGING APPLICATION SECURITY
PAGE 11
S
e
c
u
r
i
t
y
C
o
m
p
a
s
s
(
n
=
2
8
)
K
E
Y
S
E
C
U
R
I
T
Y
A
C
T
I
V
I
T
I
E
S
P
E
R
F
O
R
M
E
D
MANAGING APPLICATION SECURITY
PAGE 12
Shift-Left Activities
Testing Activities
S
e
c
u
r
i
t
y
C
o
m
p
a
s
s
(
n
=
2
8
)
4
6
%
O
F
A
P
P
L
I
C
A
T
I
O
N
-
L
E
V
E
L
R
I
S
K
S
A
R
E
N
O
T
C
O
V
E
R
E
D
B
Y
S
A
S
T
&
D
A
S
T
T
O
O
L
S
MANAGING APPLICATION SECURITY
PAGE 13
3
0
%
o
f
t
o
t
a
l
r
i
s
k
s
f
o
u
n
d
&
f
i
x
e
d
a
v
e
r
a
g
e
t
i
m
e
t
o
r
e
m
e
d
i
a
t
i
o
n
=
3
1
6
d
a
y
s
*
5
4
%
o
f
r
i
s
k
s
f
o
u
n
d
*
4
6
%
o
f
r
i
s
k
s
a
r
e
n
o
t
f
o
u
n
d
7
0
%
o
f
r
i
s
k
s
u
n
a
d
d
r
e
s
s
e
d
2
4
%
o
f
r
i
s
k
s
f
o
u
n
d
,
n
o
t
f
i
x
e
d
5
4
%
r
e
m
e
d
i
a
t
i
o
n
r
a
t
e
*
*Adapted from:
National Institute of Standards and Technology. “Report on the Static Analysis Tool Exposition IV”.
Gartner for Technical Professionals. “Application Security Think Big and Start with What Matters”.
Veracode. “State of Software Security”, 2016.
WhiteHat Security. “Web Applications Security Statistics Report”.
4
6
%
O
F
A
P
P
L
I
C
A
T
I
O
N
-
L
E
V
E
L
R
I
S
K
S
A
R
E
N
O
T
C
O
V
E
R
E
D
B
Y
S
A
S
T
&
D
A
S
T
T
O
O
L
S
MANAGING APPLICATION SECURITY
PAGE 14
3
0
%
o
f
t
o
t
a
l
r
i
s
k
s
f
o
u
n
d
&
f
i
x
e
d
a
v
e
r
a
g
e
t
i
m
e
t
o
r
e
m
e
d
i
a
t
i
o
n
=
3
1
6
d
a
y
s
*
5
4
%
o
f
r
i
s
k
s
f
o
u
n
d
*
4
6
%
o
f
r
i
s
k
s
a
r
e
n
o
t
f
o
u
n
d
7
0
%
o
f
r
i
s
k
s
u
n
a
d
d
r
e
s
s
e
d
2
4
%
o
f
r
i
s
k
s
f
o
u
n
d
,
n
o
t
f
i
x
e
d
5
4
%
r
e
m
e
d
i
a
t
i
o
n
r
a
t
e
*
F
o
r
t
h
c
o
m
i
n
g
S
C
w
h
i
t
e
p
a
p
e
r
•
Intent
•
Pointer Reference Manipulation
•
Compiler Optimization
•
Application Boundary
•
Scanner Optimization
•
Side Effects
•
Runtime Class Creation
•
Halting Problem
•
CERT Non-Automation
*Adapted from:
National Institute of Standards and Technology. “Report on the Static Analysis Tool Exposition IV”.
Gartner for Technical Professionals. “Application Security Think Big and Start with What Matters”.
Veracode. “State of Software Security”, 2016.
WhiteHat Security. “Web Applications Security Statistics Report”.
K
E
Y
S
E
C
U
R
I
T
Y
A
C
T
I
V
I
T
I
E
S
P
E
R
F
O
R
M
E
D
MANAGING APPLICATION SECURITY
PAGE 15
SOFTWARE DEVELOPMENT LIFECYCLE
T
R
A
C
K
I
N
G
T
H
E
E
F
F
E
C
T
I
V
E
N
E
S
S
O
F
A
N
A
P
P
L
I
C
A
T
I
O
N
S
E
C
U
R
I
T
Y
P
R
O
G
R
A
M
MANAGING APPLICATION SECURITY
PAGE 16
S
e
c
u
r
i
t
y
C
o
m
p
a
s
s
(
n
=
2
8
)
We have jumped straight to
validation without identifying the
root cause and implementing the
appropriate controls to reduce
application security risk.
D
O
Y
O
U
P
R
I
M
A
R
I
L
Y
B
U
I
L
D
I
N
-
H
O
U
S
E
O
R
B
U
Y
T
H
I
R
D
-
P
A
R
T
Y
S
O
F
T
W
A
R
E
?
MANAGING APPLICATION SECURITY
PAGE 17
BUILD IN-HOUSE
(ROUGHLY) EQUAL MIX OF IN-HOUSE,
COTS, AND OUTSOURCED
BUY & CONFIGURE COTS
(ROUGHLY) EQUAL MIX OF
IN-HOUSE & COTS
S
e
c
u
r
i
t
y
C
o
m
p
a
s
s
(
n
=
2
6
)
E
N
S
U
R
I
N
G
T
H
E
S
E
C
U
R
I
T
Y
O
F
T
H
I
R
D
-
P
A
R
T
Y
V
E
N
D
O
R
S
MANAGING APPLICATION SECURITY
PAGE 18
K
E
Y
T
A
K
E
A
W
A
Y
S
MANAGING APPLICATION SECURITY
PAGE 19
SOFTWARE SECURITY REQUIREMENTS
MANAGEMENT
THREAT
MODELING
REQUIREMENTS
GENERATION
ALM
INTEGRATION
TESTING
INTEGRATION
AND
AGGREGATION
Bottom line: Develop secure applications to minimize the many risks that arise from exploiting vulnerabilities
K
E
Y
T
A
K
E
A
W
A
Y
S
Adopt the correct metrics to drive your program. Strive for objective, quantified metrics that
measure risk beyond vulnerabilities (e.g. “How to Measure Anything in Cyber Security
Risk”).
Stop tracking your app sec program by the number of vulnerabilities detected by scanners
alone. Use a software security requirements management platform, (e.g. SD Elements,
OWASP Knowledge framework) and/or tool-assisted threat modelling (e.g. Microsoft threat
modelling tool). Traceable requirements coupled with test cases are more forward looking
and comprehensive.
Require your vendors to have a higher standard for secure SDLC (e.g. ISO 27034 or
vBSIMM or Microsoft's SDL).
MANAGING APPLICATION SECURITY
PAGE 20
T
H
A
N
K
Y
O
U
F
O
R
A
C
O
P
Y
O
F
T
H
E
F
U
L
L
R
E
P
O
R
T
,
P
L
E
A
S
E
V
I
S
I
T
:
h
t
t
p
s
:
/
/
w
w
w
.
s
e
c
u
r
i
t
y
c
o
m
p
a
s
s
.
c
o
m
/
m
a
n
a
g
i
n
g
a
p
p
l
i
c
a
t
i
o
n
s
e
c
u
r
i
t
y
2
0
1
7
/
O
R
E
M
A
I
L
U
S
A
T
:
i
n
f
o
@
s
e
c
u
r
i
t
y
c
o
m
p
a
s
s
.
c
o
m
Discover insights and best practices on how large organizations manage application security, including key research findings, business pressures, drivers for application security, and the importance of a systematic approach to managing security risks. The survey conducted by Security Compass reveals that a majority of respondents prioritize application security as a high or critical priority within their organizations.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
MANAGING APPLICATION SECURITY 2017 Application Security Survey by Security Compass Altaz Valani Director of Research T: @altazvalani LI: linkedin.com/in/altazvalani APRIL 27, 2017 PRESENTED AT:
PERSONAL BIO Director of Research at Security Compass (www.securitycompass.com) responsible for managing the overall research vision and team. Previously: Senior Research Director, Application Development at Info-Tech Research Group Senior Manager, KPMG Started a software development company Interests: Secure software development Teaching and learning Research and collaboration MANAGING APPLICATION SECURITY PAGE 2
ABOUT THE SURVEY PURPOSE SURVEY DEMOGRAPHIC (BY ANNUAL EARNINGS) To discover how large, complex organizations manage application security: the drivers, programs, and successes. WHO Most respondents were large multinational companies earning >$1 billion USD. THE RESULT Aggregated insights, industry trends, and best practices that illuminate how large corporations manage application security. Security Compass (n=28) MANAGING APPLICATION SECURITY PAGE 3
BUSINESS PRESSURE IS NOT GOING AWAY INCREASING SPEED OF BUSINESS INCREASING SOPHISTICATION OF RISK MANAGEMENT INCREASING PRESSURE ON COST CONTROL MANAGING APPLICATION SECURITY PAGE 5
WHAT IS DRIVING APPLICATION SECURITY? 79% of respondents stated that general risk management was the key driver for their organization's application security. Security Compass (n=28) MANAGING APPLICATION SECURITY PAGE 6
CONCLUSION: WE NEED A SYSTEMATIC WAY OF MANAGING APPLICATION SECURITY RISK VALIDATE CONTROL IDENTIFY CONTROL IMPLEMENT CONTROL 79% of respondents stated that general risk management was the key driver for their organization's application security. RISK SOFTWARE PROJECT PROGRESS MANAGING APPLICATION SECURITY PAGE 7
HOW IMPORTANT IS APPLICATION SECURITY? 73% of respondents stated that application security is a high or critical priority within their organization. Security Compass (n=26) MANAGING APPLICATION SECURITY PAGE 8
ORGANIZATIONAL SUPPORT FOR APPLICATION SECURITY (BY INDUSTRY) 1 = NO SUPPORT 5 = SUPPORT ACROSS THE BOARD Security Compass (n=21) MANAGING APPLICATION SECURITY PAGE 9
ADOPTION OF SECURITY AWARENESS TRAINING BY DEVELOPERS There is resistance to adoption of security awareness training. Many see this as extra work, getting in the way of releasing software. 1 = NO TRAINING 5 = ALL DEVELOPERS ARE TRAINED Security Compass (n=22) MANAGING APPLICATION SECURITY PAGE 10
TRACKING THE EFFECTIVENESS OF AN APPLICATION SECURITY PROGRAM 75% of respondents stated that the number of vulnerabilities found was a key metric used to track the effectiveness of their application security program. ONLY 4% of respondents stated that they used the amount of money spent on remediating vulnerabilities as a key metric to track the effectiveness of their application security program. Security Compass (n=28) MANAGING APPLICATION SECURITY PAGE 11
KEY SECURITY ACTIVITIES PERFORMED Shift-Left Activities Testing Activities Security Compass (n=28) MANAGING APPLICATION SECURITY PAGE 12
46% OF APPLICATION-LEVEL RISKS ARE NOT COVERED BY SAST & DAST TOOLS Source Code 30% of total risks found & fixed average time to remediation = 316 days* 54% of risks found* SAST & DAST 54% remediation rate* Remediation 24% of risks found, not fixed 46% of risks are not found 70% of risks unaddressed *Adapted from: National Institute of Standards and Technology. Report on the Static Analysis Tool Exposition IV . Gartner for Technical Professionals. Application Security Think Big and Start with What Matters . Veracode. State of Software Security , 2016. WhiteHat Security. Web Applications Security Statistics Report . MANAGING APPLICATION SECURITY PAGE 13
46% OF APPLICATION-LEVEL RISKS ARE NOT COVERED BY SAST & DAST TOOLS Source Code 30% of total risks found & fixed average time to remediation = 316 days* 54% of risks found* SAST & DAST 54% remediation rate* Remediation 24% of risks found, not fixed 46% of risks are not found Forthcoming SC whitepaper Intent Pointer Reference Manipulation Compiler Optimization Application Boundary Scanner Optimization Side Effects Runtime Class Creation Halting Problem CERT Non-Automation 70% of risks unaddressed *Adapted from: National Institute of Standards and Technology. Report on the Static Analysis Tool Exposition IV . Gartner for Technical Professionals. Application Security Think Big and Start with What Matters . Veracode. State of Software Security , 2016. WhiteHat Security. Web Applications Security Statistics Report . MANAGING APPLICATION SECURITY PAGE 14
KEY SECURITY ACTIVITIES PERFORMED PEN TESTING (DAST) CODE REVIEW (SAST) REQUIREMENTS S O F T WA R E D E V E L O P M E N T L I F E C Y C L E MANAGEMENT MANAGING APPLICATION SECURITY PAGE 15
TRACKING THE EFFECTIVENESS OF AN APPLICATION SECURITY PROGRAM We have jumped straight to validation without identifying the root cause and implementing the appropriate controls to reduce application security risk. VALIDATE CONTROL IDENTIFY CONTROL IMPLEMENT CONTROL RISK SOFTWARE PROJECT PROGRESS Security Compass (n=28) MANAGING APPLICATION SECURITY PAGE 16
DO YOU PRIMARILY BUILD IN-HOUSE OR BUY THIRD-PARTY SOFTWARE? BUILD IN-HOUSE (ROUGHLY) EQUAL MIX OF IN-HOUSE, COTS, AND OUTSOURCED BUY & CONFIGURE COTS (ROUGHLY) EQUAL MIX OF IN-HOUSE & COTS Security Compass (n=26) MANAGING APPLICATION SECURITY PAGE 17
ENSURING THE SECURITY OF THIRD-PARTY VENDORS MANAGING APPLICATION SECURITY PAGE 18
KEY TAKEAWAYS SOFTWARE SECURITY REQUIREMENTS MANAGEMENT TESTING INTEGRATION AND AGGREGATION THREAT MODELING REQUIREMENTS GENERATION ALM INTEGRATION Bottom line: Develop secure applications to minimize the many risks that arise from exploiting vulnerabilities MANAGING APPLICATION SECURITY PAGE 19
KEY TAKEAWAYS Adopt the correct metrics to drive your program. Strive for objective, quantified metrics that measure risk beyond vulnerabilities (e.g. How to Measure Anything in Cyber Security Risk ). Stop tracking your app sec program by the number of vulnerabilities detected by scanners alone. Use a software security requirements management platform, (e.g. SD Elements, OWASP Knowledge framework) and/or tool-assisted threat modelling (e.g. Microsoft threat modelling tool). Traceable requirements coupled with test cases are more forward looking and comprehensive. Require your vendors to have a higher standard for secure SDLC (e.g. ISO 27034 or vBSIMM or Microsoft's SDL). MANAGING APPLICATION SECURITY PAGE 20
THANK YOU FOR A COPY OF THE FULL REPORT, PLEASE VISIT: https://www.securitycompass.com/managingapplicationsecurity2017/ OR EMAIL US AT: info@securitycompass.com
