Why The Application Travelator Needs More Handrails

This article is more than 2 years old.
Adrian Bridgwater

We used to buy our software on floppy disks and CD-ROMs. But now, most of that technology has gone. Software applications and bigger chunks of code as prolific as your machine's whole Operating System (OS) now come 'over the pipe' (the Internet) as the 'download generation' of millennials and beyond have absolutely no idea what that 'disk symbol' for SAVE in Microsoft Word actually relates to.

Today, apps are Continuous

As our application downloads have gone online, so have our application updates. As most of us know, our machines periodically offer (sometimes insist) that we install the latest updates, upgrades, Service Packs and patches. What this always-on app lifestyle means in turn (at the back end) is that software application developers have to work in a new cadence that is often described as Continuous with a capital C.

The upshot of life on the continuous app travelator is that developers are moving to more rapid development cycles and application security needs to keep pace -- hence the handrail analogy. If we can't hold on to our apps and data, then we risk falling.

Security starts at ground zero

The software industry thinks it has an answer. According to the Puppet State of DevOps Report, the highest performing development teams are addressing security at every stage of the software development and delivery cycle rather than retrofitting security at the end – and they’re spending 50 percent less time remediating security issues as a result. So security now starts at ground zero, or at least it should.

The state of the nation is that 111 billion lines of new software code will be written this year alone and every line of code an organization writes makes it easier to attack. Unfortunately, static analysis, dynamic analysis and web application firewalls have all failed to keep pace with modern software development practices. CTO and cofounder at Contrast Security Jeff Williams says that we need to turn security into code itself.

“Imagine it was easy to turn security requirements, secure coding guidelines, security policies, security architecture and operational security rules into code," suggests Williams. "Teams could run these checks as they are building software to get instant feedback, accelerating development and saving money. Later in the process, teams can use these checks to ensure compliance before moving to production, without involving experts and slowing the process. Even in production, these same tests can ‘self-test’ and ‘self-protect’ running applications for vulnerabilities and attacks. All we need is a powerful platform for expressing security as code and we can radically change the way software is built and secured."

The suggestion then is that because code is released continuously, security must also work continuously. Feedback has to be instant and accurate. Developers should get instant feedback on their code. Security should be confirmed before every software release.

Similar sentiments have been expressed by software code security firm Veracode, which was recently acquired by CA Technologies. The company's latest release of its eponymously named Application Security Platform is all about what it calls Accelerated Results and Custom Cleansers.

  • Accelerated Results -- this is a technology designed to provides developers with so-called 'security findings' as each application module (basically, a smaller component of an application) finishes scanning. 
  • Custom Cleansers lets security architects extend Veracode Static Analysis to recognise 'custom cleansing functions' for common vulnerabilities including SQL injection, URL redirection, log forging, and header injection.  

“Developers want to reduce risk in their applications while maintaining the speed of development that [continuous] environments demand,” said Tim Jarrett, senior director of enterprise security strategy, Veracode. “By allowing them to review results faster and removing noise from the results, with the added advantage of support for legacy code, the new features within Veracode’s Application Security Platform empower businesses to secure more of their application portfolios with fully automated security testing.”

It's all about the automation

Specifically with the custom cleansing function, it comes back to that word that we see time and time again in the way software is being created today i.e. automation. Where we can automate actions based on defined principles and mathematical facts that we have ratified elsewhere, we can take that knowledge forward and apply it to other parts of what we call the SDLC - the Software Development LifeCycle.

Going back to airport travelators and handrails, does our analogy hold water? Well, if a family of four with a bunch of vacation-hyped kids is traveling with additional luggage at the busiest time of year during the summer break, then doesn't that make them a high risk for tripping up? We can automate for that... and we should.

Follow me on Twitter or LinkedIn.
