staging-devopsy.kinsta.cloud

Tag: devsecops

  • A DevSecOps Process for Node.js Projects

    A DevSecOps Process for Node.js Projects

    Node.js is an open source development platform for running JavaScript code on the server side. Node is useful for developing applications that require a persistent browser-server connection and is often used for real-time applications such as chat, social applications, or news feeds. 

    DevSecOps is a way for development, security, and operations teams to work together throughout the project life cycle. It is often implemented by adding security to existing DevOps teams and agile processes.

    The idea behind this collaboration is to incorporate security early in the development process. This is called shifting security left. As security moves to the “left” of the development process, application vulnerabilities and bugs are discovered and addressed faster. This leads to more secure product releases with a reduced need to apply patches and troubleshoot in production. Applying DevSecOps to Node.js development can improve both the efficiency and security of Node.js projects.

    Common Node.js Attack Vectors

    Here are a few cyber threats that affect many Node.js applications.

    Cross-Site Scripting (XSS)

    XSS attacks inject manipulated client-side JavaScript code. Web apps are vulnerable to XSS if they don’t validate inputted hostnames from the DNS. Attackers can use forms to enter malicious scripts and hack into the system. In some cases, entering code into the filename can trigger cross-site scripting in the target browser. 

    A hacker can use your file upload form to hack into your system. There are many ways for this vulnerability to lead to a system compromise. Though usually mitigated by modern front-end frameworks, in some cases it may happen that putting javascript into the filename will trigger XSS in a user’s browser, allowing the theft of session IDs. In other cases, an attacker might get sensitive server information by uploading a file to the Node.js server and running it by exploiting a path traversal vulnerability.

    Code Injection

    Developers are responsible for writing secure application code, but it’s impossible to fully guarantee the code’s security when using open source components. A code injection attack involves injecting malicious code into the target system and forcing the application to execute it, allowing attackers to access the codebase. Inadequate data validation often results in code injection vulnerabilities.

    Default Cookie Names

    Cookies help web apps identify specific users by storing user actions in the underlying infrastructure (e.g., an eCommerce shopping cart that remembers the items a customer selects). 

    Developers should use custom names for cookies (rather than defaults) to prevent attackers from identifying and targeting cookies and extracting data. 

    Brute Force Attacks

    Brute force attacks often affect Node.js applications. An attacker randomly generates millions of passwords to find one that works, logging in to the application. You can prevent brute force attacks by strengthening the authentication mechanisms, limiting the number of permitted login attempts from a single IP, and encrypting stored passwords (using bcrypt.js).

    Cross-Site Resource Forgery (CSRF)

    This type of session hijacking forces an authenticated user to execute malicious actions on the target web application. The attacker hijacks a legitimate user’s session to bypass security controls and change the application’s state. CSRF can force users to transfer funds or change their account details, potentially compromising the web application’s security. 

    Node.js Security Best Practices

    Implement Strong Authentication

    A compromised, weak, or incomplete authentication mechanism is a common vulnerability. Many developers think of authentication as something that “just works”. However, authentication can easily be bypassed by attackers if not implemented correctly.

    In Node.js, you have the option of using the default Node.js authentication solution. There are a few things to keep in mind: 

    • Do not use Node.js’s built-in password library when generating passwords, use Bcrypt. 
    • Limit failed login attempts and do not notify users if their username or password is incorrect. Instead, return a generic “Invalid Credentials” error. 
    • Have a robust session management strategy. 
    • Implement two factor authentication (2FA). This can be done using modules like node-2fa.

    Alternatively, use one of many third-party solutions available for application authentication, which may be superior to built-in Node.js functionality. 

    Avoid Errors That Reveal Too Much

    There are many things to consider when building error handling functionality: 

    • Don’t give the user any details they don’t really need. Never return the entire error object to the client. It may contain information that you do not want to disclose, such as paths, other libraries you are using, or secrets. 
    • Wrap the path in a catch clause so that Node.js doesn’t crash if the request triggers an error. This prevents the app from crashing continuously, allowing attackers to send malicious requests that cause the app to crash.
    • Don’t expose your Node.js app directly to the internet. Use a component like a load balancer, cloud firewall or gateway. This means DoS attacks will be one step removed from your Node.js application.

    Using Security Linters to Capture Vulnerabilities in Code

    Code linters help identify various issues in code before compiling. They let you detect the most common issues and ensure you follow best practices.

    Code linters have their own rules, which you can customize according to your requirements. Before using a linter, make sure you enable rules related to security vulnerability detection in the linter configuration.

    Server-side Logging and Monitoring

    A good logging library provides developers with powerful troubleshooting and monitoring capabilities. On the other hand, unnecessary or excessive logging affects application performance and consumes more resources. Therefore, you should only use reasonable log levels when deploying applications to production environments.

    When constructing log messages, they must be in a format that can be read and understood by humans and machines. Logging ambiguous messages can lead to misunderstandings among developers. An error message must not only describe the problem but also advise what the user can or should do to fix it.

    It is also important to ensure that your logging mechanism captures all relevant information such as IP addresses, usernames, and actions taken. 

    Never retrieve or store sensitive information in application logs. This violates compliance standards such as PCI and GDPR. However, there are times when you need to record this information for troubleshooting – in this case, it is recommended to mask or anonymize sensitive information before writing it to the log.

    Implementing Node.js Security in a DevSecOps Organization

    Node.js security best practices are well known and security awareness is growing among Node.js developers. However, many organizations don’t have a clear organizational structure for implementing development best practices. Here are a few steps your organization can take to transition a Node.js development team to a full DevOps model:

    1. Adding mandatory guard rails for developers

    For example, adding static application security testing (SAST) within the IDE and on every commit. Linters should be deployed centrally with a consistent configuration for all developers in the team.

    1. Automated security testing in staging environments

    During the CI/CD process, when a Node.js application is deployed to a staging environment, there should be automated tests that can identify security misconfigurations and integration-related vulnerabilities. Dynamic application security testing (DAST) tools are ideal for this purpose.

    1. Runtime protection

    No DevSecOps process is complete without a safety net to identify security issues in production. This requires the use of tools like web application firewalls (WAFs), which can detect and block malicious traffic, and runtime application self-protection (RASP), which can proactively respond to attacks. Both these tools provide feedback to DevOps teams to help them identify and remediate vulnerabilities in the underlying application.

    By implementing these three stages, you can be sure that Node.js security is not just an ad-hoc practice but a formalized, coordinated process involving developers, operations teams and security experts. 

    Conclusion

    In this article, I explained the basics of DevSecOps and how to secure Node.js:

    • Implement strong authentication—In Node.js, you have the option of using the default Node.js authentication solution.
    • Avoid errors that reveal too much—Don’t give users more details than they actually need when displaying errors.
    • Using security linters to capture vulnerabilities in code—Code linters help identify various issues in code before compiling.
    • Server-side logging and monitoring—A good logging library provides developers with powerful troubleshooting and monitoring capabilities.

    I hope this will be useful as you implement Node.js security in your DevSecOps organization.

  • FAA Ground Stop due to Technical Debt? | Don’t Do DIY Crypto!

    FAA Ground Stop due to Technical Debt? | Don’t Do DIY Crypto!

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: The FAA’s NOTAM database gets corrupted, and Threema shows why DIY cryptography is bad. (more…)

  • AppSec in the Cloud: What DevOps Teams Should Know

    AppSec in the Cloud: What DevOps Teams Should Know

    Cloud application security refers to the measures and controls that are put in place to protect cloud-based applications and data from cyberthreats, unauthorized access and data breaches. These measures can include technical controls such as encryption, access controls and secure networks, as well as operational controls like policies and procedures for managing and securing data in the cloud.

    Cloud application security is important because it helps to ensure the confidentiality, integrity and availability of data and applications in the cloud. It is especially critical for organizations that store sensitive or regulated data in the cloud, as a security breach could have serious consequences for the organization and its customers.

    There are many different approaches to cloud application security, including the use of security protocols, identity and access management (IAM) systems and security information and event management (SIEM) tools. Some organizations may also choose to use cloud security platforms, which provide a range of security services and tools that can be used to protect cloud-based applications and data.

    How DevOps Secures the Cloud

    DevOps is a software development approach that aims to optimize the collaboration and communication between development and operations teams to deliver software more quickly and efficiently. It involves using automation, continuous integration and delivery and other tools and practices to streamline the software development process.

    Cloud security operations, or CloudSecOps, refers to the practices, processes and tools used to secure and manage cloud-based applications, systems and data. CloudSecOps is a key aspect of DevOps, as it helps to ensure that cloud-based applications and systems are secure and compliant, while also allowing for rapid deployment, scaling and management of applications in the cloud.

    There are several key ways that CloudSecOps can be implemented in the cloud as part of a DevOps approach:

    • Automated security testing: CloudSecOps can be implemented using automated security testing tools, which can be integrated into the CI/CD pipeline to continuously test and validate the security of code changes.
    • Identity and access management: CloudSecOps involves using identity and access management (IAM) systems to control and monitor access to cloud-based resources. These systems can be integrated into the DevOps process to ensure that access to cloud-based systems is properly managed and secured.
    • Security as Code: CloudSecOps can be implemented using security-as-code practices, which involve writing security policies and controls in code and integrating them into the CI/CD pipeline. This allows organizations to automatically enforce security controls as part of the software development process.

    4 Cloud Application Security Best Practices

    Understanding and Monitoring Dependencies in Cloud Applications

    Application dependency mapping is a technique that can be used to visualize and understand the dependencies between different components of a cloud application. This can help organizations identify and manage the risks associated with dependencies and ensure that all application components are up-to-date and secure.

    There are several key benefits to using application dependency mapping as a cloud application security best practice:

    • Improved visibility: Application dependency mapping provides a clear and comprehensive view of the dependencies between different components of the application, which can help organizations to better understand the risks associated with these dependencies.
    • Improved risk management: By understanding the dependencies between different application components, organizations can identify and prioritize the most critical dependencies and take steps to mitigate any associated risks.
    • Improved security: By regularly monitoring dependencies for updates and vulnerabilities, organizations can ensure that all application components are secure and up-to-date.
    • Improved compliance: By understanding and managing the dependencies between different application components, organizations can ensure that they meet compliance requirements for storing and processing data in the cloud.

    Cloud Database Security

    Cloud database security is a critical aspect of cloud application security, as it involves the measures and controls that are put in place to protect data stored in the cloud from cyberthreats, unauthorized access and data breaches. 

    Ensuring the security of cloud-based databases is important because these systems often store sensitive or regulated data. A security breach could have serious consequences for the organization and its customers.

    There are several key best practices for ensuring the security of cloud-based databases:

    • Encryption: Encrypting data at rest and in transit can help to protect against unauthorized access to data stored in the cloud.
    • Access controls: Implementing fine-grained access controls can help to ensure that only authorized users have access to data stored in the cloud.
    • Security monitoring: Monitoring for security events and anomalies can help to identify and respond to potential threats to data stored in the cloud.
    • Compliance: Ensuring that cloud-based databases meet compliance requirements for storing and processing data is an important best practice to protect against data breaches and ensure regulatory compliance.

    Apply Cloud Governance Policies

    Cloud governance refers to the practices, processes, and controls used to manage and govern the use of cloud-based resources and services. Some of the key ways that organizations can apply cloud governance policies to improve the security of their cloud-based systems include:

    • Establishing policies for access and use: Organizations can establish policies that define who has access to cloud-based resources and how they can be used. This can help to ensure that access to sensitive data and systems is properly controlled and monitored.
    • Implementing security controls: Organizations can implement security controls such as encryption, access controls and secure networks to protect data and systems in the cloud.
    • Ensuring compliance: Organizations can establish policies and procedures to meet compliance requirements for storing and processing data in the cloud.
    • Monitoring and auditing: Organizations can establish policies for monitoring and auditing the use of cloud-based resources to ensure that they are being used in accordance with established policies and procedures.

    Identify, Categorize and Protect Sensitive Data Stored in the Cloud

    Sensitive data refers to information that is highly confidential or regulated and that requires special protection to ensure its confidentiality, integrity, and availability. There are several key steps that organizations can take to identify, categorize and protect sensitive data stored in the cloud:

    1. Identify sensitive data: The first step is to identify the sensitive data stored in the cloud. This may include personal data, financial data, intellectual property and other types of sensitive information.
    2. Categorize sensitive data: Once the sensitive data has been identified, it is important to categorize it based on its level of sensitivity and the potential risks associated with it. This can help organizations to prioritize the protection of different types of sensitive data.
    3. Protect sensitive data: There are several different measures that organizations can take to protect sensitive data stored in the cloud, including encryption, access controls and secure networks. It is also important to implement policies and procedures to ensure that sensitive data is handled and processed securely.

    Conclusion

    In conclusion, application security in the cloud is a critical concern for DevOps teams, as it involves the measures and controls that are put in place to protect cloud-based applications and data from cyber threats, unauthorized access, and data breaches. 

    To ensure the security of their cloud-based systems, DevOps teams should implement a range of best practices, including understanding and monitoring dependencies, implementing security controls, managing identities and access, and ensuring compliance. By following these best practices, DevOps teams can help to ensure the security and integrity of their cloud-based systems and protect against potential threats.

  • Are We Delivering?

    Are We Delivering?

    I had an interesting conversation today where I was told, “We do great with CI but terrible at the CD part.” My immediate reaction was to point at all the great CD activity going on in vendor space right now. But as I stopped to ponder, I realized that we’re doing all of that great CD activity to play catch-up.

    DevSecOps has us covered in spades—the toolsets allow for scanning and protection all through the process, from the first line of code to application retirement. I would argue that after being left out in the cold, DevSecOps has done a better job than DevOps at the right side of the equation.

    In DevOps, the various “cloud-native” deployment models (I use scare quotes because they’re not really cloud-native. If you dig into them, nearly every one of them includes Kubernetes in their definition of cloud) are starting to do the job admirably, but in shops starting to automate the entirety of the process, the CI part has been automated and code delivery accelerated for a good long while.

    In short, adoption seems to prove, once again, that the benefits of rapid development are more important than the benefits of offering a stable, repeatable deployment environment. This makes one wonder what, exactly, we should be doing to convince IT and business leaders in orgs smaller than web monsters that security and repeatability both demand the implementation of capable continuous delivery.

    I think we failed the audience when we allowed pundits to blather on and on about deploying thousands of times a second when most applications in most orgs need to deliver at a significantly slower pace. And not only that, but want to deliver at that slower pace, given the “Don’t fix what isn’t broken” rule. Even if the environment is stable, rolling out for a single minor bug fix is possible but it’s not the best use of time—both computer and human.

    But we are catching up. We have things like GitOps and Kubernetes automation catching up with the rate of development; security is already there and test automation is ready to find issues before deployment. It is simply implementation that is behind and, as time goes on, more orgs will get the implementation part nailed.

    And through that process, you’ll be there, rocking it. Step up and make sure it is done right. The entire process is there; you could sleep better at night knowing that it is all in place and you are not likely to get a midnight call. Your org loves stability, you love good nights of sleep … Go out and get it.

  • Will DevSecOps Replace the Security Operations Center?

    Will DevSecOps Replace the Security Operations Center?

    Traditionally, a security operations center (SOC) is a physical facility where an organization performs information security activities. The SOC team analyzes and monitors the organization’s security systems. A SOC aims to protect businesses from security breaches by identifying, analyzing and responding to cybersecurity threats. 

    The SOC team consists of administrators, security analysts and security engineers. They work in collaboration with internal development and IT operations teams.

    A SOC is a proven method to improve threat detection and incident response, reduce the potential for security breaches and help organizations respond appropriately in the event of an incident. The SOC team isolates unusual activity on servers, databases, networks, endpoints and applications, identifies and investigates security threats and responds to security incidents as they occur.

    SOCs were once considered suitable only for very large organizations. But many small organizations today are building lightweight SOCs, such as hybrid SOCs that rely on a combination of part-time in-house staff and outsourced experts or virtual SOCs that function without physical facilities.

    SOC Challenges

    SOCs play a critical role in protecting an organization’s assets from cyber threats and ensuring the security and integrity of its networks and systems. However, SOCs can face a variety of challenges in their efforts to detect and respond to potential threats, including:

    Alert Overload

    Alert overload is a common challenge faced by SOCs. It occurs when the SOC team is inundated with too many security alerts, making it difficult to prioritize and effectively respond to them. This can be caused by a high volume of alerts, a lack of context or proper prioritization, limited visibility, or limited resources. To address the challenge of alert overload, SOC teams may implement strategies such as tuning security tools, implementing a triage process, utilizing automation, and increasing the size of the team.

    Visibility Gaps

    Visibility gaps refer to areas of an organization’s networks and systems that are not adequately monitored or protected by security tools and processes. These gaps create vulnerabilities that cyber threats can exploit, making it difficult for SOC teams to detect and respond to potential threats. 

    Visibility gaps may be caused by complex environments, limited resources, shadow IT, or misconfigured systems. To address visibility gaps, SOC teams may implement strategies such as implementing a security information and event management (SIEM) system, conducting regular assessments, implementing additional security controls, educating employees and ensuring that systems are properly configured.

    Complex Investigations

    Investigating cybersecurity threats can be a challenging task for SOC teams. It requires them to quickly and accurately identify the root cause of the threat and take appropriate action to contain and mitigate it. This can be difficult due to limited visibility, complex environments, a lack of context or limited resources. 

    To aid in the investigation process, SOC teams may use forensics tools to gather and analyze evidence related to potential security incidents. Common tools include network forensics tools, which allow the team to analyze network traffic and identify the source of a threat and digital forensics tools, which allow the team to examine devices and systems to identify evidence of an incident. 

    Slow Detection and Response Times

    Slow detection and response times are a common challenge faced by security operations centers (SOCs). They can impact the organization’s mean-time-to-detection (MTTD) and mean-time-to-response (MTTR), which measure how long it takes the SOC team to detect and respond to potential security incidents. 

    A high MTTD and MTTR can have serious consequences for an organization, as it may allow a cybersecurity threat to remain active for an extended period of time, potentially causing significant damage.

    What Is DevSecOps?

    DevSecOps stands for development, security and operations. It is a new work process that involves integrating security practices into all DevOps processes. The DevSecOps mindset guides all technical experts equal access to security expertise.

    DevSecOps moves security practices and enforcement early in the development process. This creates a culture where security is everyone’s responsibility, not just that of the security team.

    Building security into every phase of the software delivery life cycle enables continuous integration and high development velocity with fewer security issues and lower compliance costs.

    How DevSecOps Improves Security and Quality

    Organizations using the DevSecOps model understand that security should not be an afterthought and should be a core part of the software development life cycle (SDLC).

    DevSecOps collaboration is more difficult than DevOps because it requires achieving two seemingly contradictory goals simultaneously—expediting the delivery process while spending more time to make sure code is secure and free of bugs.

    To implement DevSecOps without compromising product quality, organizations need to create a culture that deals with security-as-code, encouraging developers to consider the security aspects of their projects and automate security tasks. Organizations need to establish ongoing communication and collaboration between IT engineers, software developers and security teams.

    How DevSecOps Processes Are Transforming the SOC

    Traditionally, SOC processes were completely isolated from the rest of the organization. Developers would build systems, IT Ops run systems, and security protected them. Today, it is understood that merging these three functions into one organization that shares responsibility for security improves security and significantly increases operational efficiency.

    SecOps was a second phase, in which operations and security teams became one organization. Security was shifted left, starting from early stages of IT requirements and system design, not at the end of the process.

    SecOps had a major impact on organizations implementing DevOps. It paved the way for the third phase—broader collaboration between security, operations, and software development teams, known as DevSecOps. This moves security even further to the left, building security into the system from the first iteration of development.

    DevSecOps can operate in parallel to a SOC. Here are some ways SOCs can modernize their processes, even if the SOC itself is a silo:

    • Develop a decentralized SOC with DevOps members: Department members familiar with DevOps can help with incident response by gaining insight into IT systems and understanding vulnerabilities and threats to security personnel.
    • Collaborate with threat hunters and DevOps teams: Instead of isolating threats and reporting them to management, threat hunters can communicate directly with development or operations teams to address key security vulnerabilities.
    • Create a Center of Excellence: SOCs can work with development and operations teams to adopt security best practices and spread these positive results throughout the organization to promote DevSecOps practices.
    • Allow the SOC to provide advice and guidance: Everyone involved in security should have easy access to the SOC and be able to work with the organization’s top security experts.

    Conclusion

    In conclusion, while DevSecOps can significantly impact how SOCs operate, it is unlikely to completely replace the SOC. DevSecOps emphasizes the integration of security practices and tools into the development process from the beginning, which can help to prevent security incidents from occurring in the first place. However, it is still important for organizations to have a dedicated team in place to monitor for and respond to potential security incidents.

    The SOC will continue to play a critical role in protecting an organization’s assets from cybersecurity threats and ensuring the security and integrity of its networks and systems. By adopting DevSecOps practices, the SOC can improve the security and quality of the organization’s software applications, reduce the risk of security incidents and improve the efficiency of its operations. However, the SOC will remain a vital part of the organization’s overall security posture and will continue to evolve and adapt to new challenges as they arise.

  • How SASE Can Ease DevSecOps Adoption

    How SASE Can Ease DevSecOps Adoption

    DevSecOps is a software development methodology that merges development (Dev), security (Sec) and operations (Ops) into one team that integrates security throughout the entire software development life cycle (SDLC). The goal is to deliver high-quality applications quickly and securely.

    The traditional software development life cycle introduces security in the late phases of the SDLC. However, this approach cannot protect against sophisticated cybersecurity attacks. Today’s cybersecurity landscape requires shorter, frequent iterations to quickly patch and fix security issues. DevSecOps integrates security into the continuous integration and continuous delivery (CI/CD) pipeline to ensure teams can address pressing security issues at DevOps speed. 

    Many organizations are enthusiastically adopting DevSecOps but, in the process, discover they don’t have the necessary infrastructure. DevSecOps requires smooth global collaboration between teams and requires that security controls are built into the IT environment. This is where SASE comes in.  

    What is Secure Access Service Edge (SASE)?

    Secure access service edge (SASE) is a network security model that provides network connectivity with security based on identity, real-time security context and corporate security policies. It is aligned with the zero-trust security paradigm, ensuring that connections are denied by default unless a verified identity has permission to access a specific application, service or edge location. 

    SASE unifies networking and security functions into one fully integrated service delivered in the cloud. SASE includes several technologies: software-defined wide area networking (SD-WAN), secure web gateway (SWG), cloud access security broker (CASB), next-generation firewall (NGFW) and zero-trust network access (ZTNA).

    A key benefit of SASE is enhanced network security. SASE services enhance network security with a granular approach to network protection, detecting and blocking network attacks such as distributed denial of service (DDoS) attacks, man-in-the-middle (MitM) attacks, phishing, email spoofing and malware with deep security scans. 

    Additional benefits of SASE include: 

    • Lower cost compared to traditional networks because SASE includes fewer on-premises hardware components and features previously purchased from multiple vendors. 
    • Easier maintenance because it provides one pane of glass that allows IT teams to manage all applications and users wherever they are. 

    Components of SASE

    Cloud-access Security Broker (CASB)

    CASB acts as a bridge between users/devices and cloud applications. It allows organizations to apply security policies, two-factor authentication and single sign-on to all cloud applications, preventing unauthorized devices and individuals from accessing sensitive assets and denying access by default.

    Zero-Trust Network Access (ZTNA)

    ZTNA ensures that users or devices have explicit permission to access applications or resources. It is a critical component of a zero-trust security architecture, ensuring that internal, private applications are hidden from users who should not have access to them. It also enables secure remote access through layered authentication. ZTNA provides flexible security to meet modern security requirements.

    Software-Defined Wide-Area Networking (SD-WAN)

    SD-WAN is a connectivity architecture that separates network hardware from the physical control layer. It improves network performance by enhancing and simplifying WAN performance and management. SD-WAN supports modern, cloud-based applications and services while reducing connectivity costs. Combining SD-WAN with advanced security features provides a foundation for enterprises to transition to SASE.

    Secure Web Gateways (SWG)

    SWG protects online devices from malware infection, enforces corporate security policies and filters unwanted websites in user-initiated internet traffic. SWG provides URL filtering, application control, DLP, antivirus, sandboxing and SSL inspection. All these capabilities protect users from harmful websites and enforce security policies while ensuring full web access and promoting productivity.

    Firewall-as-a-Service (FWaaS)

    FWaaS is a firewall solution delivered as a cloud-based service. It provides hyperscale next-generation firewall (NGFW) features, including web filtering, advanced threat protection (ATP), intrusion prevention systems (IPS) and domain name system (DNS) security. By integrating FWaaS into the SASE platform, organizations can provide a wide range of cybersecurity capabilities at the edge.

    Centralized and Unified Management

    The modern SASE platform enables IT administrators to manage SD-WAN, SWG, CASB, FWaaS and ZTNA with centralized, unified management across networks and environments. This allows IT team members to focus on more pressing areas and improves the user experience for the organization’s mixed workforce.

    How SASE Will Impact DevSecOps and Security in Organizations

    SASE can help secure internal interactions and applications. As a result, the burden on DevSecOps teams is reduced. DevOps teams can use zero-trust network access (ZTNA) to further secure the applications running on SD-WAN. These technologies keep all interactions between endpoints and applications secure.

    The SASE model can also help protect mission-critical applications and sensitive data that cannot run on the public internet. To protect these assets, SASE obfuscates traffic, restricts access with a zero-trust architecture, and secures all network entry points with NGFW. It continuously evaluates application traffic for security threats.

    Facilitating Collaboration 

    DevOps teams are focused on time-to-market and are constantly working to accelerate the CI/CD pipeline. They need to collaborate remotely over a reliable and secure connection. DevOps teams are also working to reduce their reliance on network and security teams. The SASE model helps address these problems.

    SASE helps reduce collaboration issues by unifying WAN and network security. SASE solutions provide optimized performance and strong security, so DevOps teams don’t depend on infrastructure staff to provision resources. It gives teams full control over operations without compromising performance or security.

    Providing Built-In Security

    SASE offers the basic network security features required to secure a DevOps project. This allows teams to integrate different security mechanisms into their networking stack, with all security services sharing an integration context. This plugs the gaps in traditional security architecture often exploited by attackers and protects applications from threats.

    Improving Incident Response

    SASE can immediately block various attack vectors with security controls embedded in the network fabric, supporting the incident response team’s efforts. SASE increases visibility into behavioral anomalies and security incidents in a hybrid environment.

    Integrating SASE solutions into a security information and event management (SIEM) system allows incident responders to gain greater visibility into traffic anomalies and the automated security actions taken by the SASE tools. SASE features like NGFW, SWG, IPS and anti-malware might already contain or eliminate many incidents.

    Providing More Reliable Infrastructure 

    DevOps teams need fast, reliable application performance. SASE offers integrated load balancing and failover capabilities that can significantly improve the network’s overall performance. 

    The SASE architecture can connect all the edge devices, remote users, data centers and cloud resources to a secure, self-healing, fully optimized global network. If a circuit fails or the path becomes congested, the fabric can automatically switch to an alternate path.

    Conclusion

    In this article, I introduced DevSecOps and showed how SASE, a modern platform that provides fast network connectivity and security at the edge, can support its adoption. DevOps teams can use SASE security components to secure applications across on-premises data centers and clouds. SASE can encrypt and inspect traffic to protect it from threats, ensuring that workloads, users, and development systems are secure by default. 

    With SASE, DevSecOps teams have the infrastructure they need to secure the environment and can focus on integrating security tests and remediations into the development life cycle.

  • Prioritizing Product Security With DevSecOps

    Prioritizing Product Security With DevSecOps

    Building software with strong security can no longer be an afterthought for organizations. The need for a reliable cybersecurity posture has proven vital amid the constant attacks we’re seeing across industries, all over the world. Product-specific security is top of mind for most companies, and a successful product security practice requires integrating with the ethos of the engineering team—DevSecOps. Consider a three-fold strategy, which has proven successful again and again in the industry.

    It consists of first creating a culture of security, with all stakeholders understanding the priorities, strategies, and business value. Second, teams must integrate security with the software development life cycle (SDLC). It’s not enough to shift left–organizations must shift their thinking from shift left to shift everywhere. And lastly, monitoring product systems at all times is non-negotiable. In a 24/7/365 world, there must be teams to watch over security 24/7/365. Part of the engineering deliverable becomes providing data to these teams so that they can have all eyes on the products, always.

    A Successful Practice Starts With the Culture

    In building a strong culture, the goal is to make the entire engineering team a part of the mission. This includes putting a product security team in place to support engineering needs as well as providing continuous education with resources available for addressing any eventuality.

    While every organization has its own unique needs, considerations and approaches to creating a product security team, these five roles are highly recommended:

    1. Technical Product Manager (TPM): Responsible for driving security priorities in planning
    2. Security Architect: Sits on the Architecture Review Board and ensures architecture and design have security processes incorporated
    3. AppSec Engineer: Responsible for implementing the security development life cycle
    4. Adversarial Engineer: Hammers on the attack surfaces to identify weaknesses
    5. Security Champions: Engineers from each Scrum team with an interest in supporting their teams with security fundamentals; they are instrumental in scaling out the overall product security effort

    Creating and executing an engaging security education program is also pivotal to winning over the hearts and minds of employees. Consider initiatives such as in-depth security boot camps, vulnerability-of-the-month presentations, capture-the-flag (CTF) contests and security consultation programs.

    Integrating Security Into the SDLC

    From a high level, all SDLCs consist of planning, development and release, and each phase should have its own set of security controls.

    Planning: The product security TPM is responsible for working with the product management team to determine security priorities–derived from sources like risk reduction, executive priorities, customer requests, security findings and regulatory requirements. Determining what is most important is key.

    Development: Much of the heavy product security lifting comes during the development phase, which includes implementing threat modeling, security baselines and automated scanning.

    Threat modeling: The process of identifying potential threats in a system. Once identified, the threat modeling team can create mitigations, and results are integrated into penetration testing to verify that the threats did not make it into implementation. It’s most efficient to test models during the architecture phase before coding begins to avoid rework and Band-Aids. For example, a company may have a policy disallowing access to port 22 from the Internet. Threat modeling automation can detect violations in the design and notify the owning team asking them to close the port. Tools that support this use case include IriusRisk and ThreatModeler, as well as Microsoft Threat Modeling Tool, which is a free option but does not include automation.

    Security Baselines: Teams should create secured images that are fully patched, meet security policies and have mandatory security agents preinstalled. Doing this for both OS images and containers allows developers to get a level of security for “free” and avoid ongoing security reviews. Baselines should automatically update and flow into CI/CD systems.

    Automated scanning: To keep up with Agile processes, scanning should be automated and have a low number of false positives. In fact, it is better to report on fewer issues than kill credibility with a lot of noise. Continuous tuning will increase the fidelity rule sets and helpful tools include static application security testing (SAST), software composition analysis (SCA), and dynamic application security testing (DAST). Automation is critical to securing applications that use a CI/CD development process and providing security right at the code push is invaluable–developers get immediate feedback, not a ticket weeks later when they likely have forgotten important context. Integrating these tools into build pipelines is a solved problem.

    For example, the below YAML demonstrates automating source scans for embedded secrets (e.g., passwords and keys).

    sast:secrets-detection:
    extends: .sast:secrets-detection
    stage: deployment:development

    Release: When teams reach the release phase, adversarial testing becomes an important component. Penetration testing can be in-house, outsourced or both. An internal red team will have a better understanding of the technology and, therefore, have a broader scope than external security partners. For example, they test across product boundaries, test processes and people and test live production systems. For a mature product, consider a bug bounty program. This will invite white hat hackers to find weaknesses in exchange for cash. But “mature products” is essential; otherwise, the number of payouts will become overwhelming.

    24/7 Monitoring

    As mentioned earlier, 24/7 monitoring is key, especially for any cloud-based technology. A dedicated security operations center (SOC) can help, scrutinizing for threats against the company, employees and customers. The SOC’s responsibilities are much broader than those of a product security team, and they allow product security folks to sleep well at night. Security teams should configure systems, load balancers, public cloud platforms and networks to feed data directly into the security information and event management (SIEM) system. The SOC can then respond to custom automated alerts that identify any data anomalies that are being streamed to them.

    As products–and technology overall–become more advanced, the way organizations secure them must do so as well. The perfect security approach varies from business to business, but empowering IT, engineering and security teams is a beneficial first step to identifying, optimizing and integrating security for both employees and customers.

  • How Devs Can Improve Open Source Security in the Enterprise

    How Devs Can Improve Open Source Security in the Enterprise

    Modern applications are dynamic. They’re distributed and they’re often born in the cloud. These applications can be developed on the fly, spun up and scaled quickly to meet evolving user and market demands—enabling a level of business agility that allows users to make quick, informed decisions in real-time and take advantage of opportunities as they arise.

    Enabling this development velocity are tens of thousands of open source libraries–pieces of code that developers can include in their applications to perform a specific function without having to code it from scratch. Open source libraries prevent developers from having to reinvent the wheel and allow them to focus on their differentiated business logic. While efficient and a major time saver, open source software may be the biggest single threat to software supply chains today. Developers simply have too much faith in the integrity of free, open source code that they casually include and distribute with their applications.

    Despite the operational benefits, the pressure to develop quickly shouldn’t expose the organization to increased security risks. Development teams need to rethink how they use open source software and take steps to ensure they meet the same security standards as other enterprise applications.

    The Open Source Security Issue

    The problem is that most open source projects are maintained by a small number of developers that contribute their time and expertise to build software components that can be reused by the community at large. However, these developers are volunteers who aren’t being paid for their time and effort, nor are they under the same pressure as enterprise developers to ensure there are no vulnerabilities in their code. They may also lack the level of enterprise security expertise necessary to protect applications from increasingly sophisticated attacks. Some may even be hostile to efforts to better secure their code if it means slowing performance or changing the user experience.

    The result is that insecure code is increasingly making its way into enterprise applications that use these open source libraries. In fact, the Log4j vulnerability last year was due to a vulnerability in an open source Java logging library. Recognizing the national security importance of open source software, the Biden administration recently issued an executive order and met with cybersecurity professionals to better safeguard the federal government’s computer systems. The resulting recommendations included policies that would help prevent security vulnerabilities in open source packages, improve the process for identifying and fixing defects and reduce time to remediation for distributing and implementing fixes. 

    It’s imperative that the private sector take notice and make more of an industry-wide effort to secure open source software that makes up businesses’ most critical applications today.

    Three Steps for Better Open Source Security in the Enterprise

    The bottom line is that enterprises themselves need to take more responsibility for securing enterprise applications—especially as these applications rely more on open source libraries. They need to take a more proactive approach that spans the entire software life cycle, embeds security tools directly into development platforms and provides complete transparency into what makes up their most critical applications.

    Here are three things organizations can do to make sure their open source software is secure:

    1. Continuously conduct end-to-end application testing

    Modern applications are constantly evolving—making it more imperative than ever to continually test for vulnerabilities throughout the entire software life cycle. Starting with the planning stage, security should be embedded throughout the process—providing developers with a solid framework for building secure code before it goes through testing. Once pushed, application security testing should continue as an automatic, built-in step when pushing code to production. DevOps and security teams should work together to ensure security is no longer an afterthought to feature development.

    2. Embed enterprise security capabilities directly in development platforms

    Forcing developers to take an extra step to ensure secure code when they’re already under pressure to push code quickly is a recipe for failure. Security teams must make it as easy as possible by integrating security controls directly into existing development processes. Standardizing security testing and controls during development makes it more likely policies are recognized, understood and followed.

    3. Ensure transparency in every snippet of code you use

    Complexity is the enemy of good application security. DevOps teams need to know exactly what makes up their applications—including open source libraries and their dependencies. The federal government is pushing the open source community to standardize a software bill of materials (SBOM). Similar to regulations that require hardware manufacturers to know where every part is sourced, this would force both open source developers and enterprise developers to take more responsibility for the code they include from other sources. That way, if a vulnerability is discovered in a library, enterprises could easily determine if they are at risk and take appropriate action to fully mitigate the issue as quickly as possible.

    It’s Time to Take Greater Responsibility

    Open source software enables the kind of development agility that makes businesses thrive, but open source also greatly expands enterprise threat surfaces—leaving many organizations at risk of a breach. Organizations need to take greater responsibility for the security posture of the open source libraries they use to speed application development. This requires end-to-end application testing throughout the entire software development life cycle; embedded security tools and controls in development platforms and processes and complete transparency into the open source software that makes up critical enterprise applications. This proactive approach will ensure that vulnerabilities such as Log4j are identified and patched quickly before threat actors are able to exploit them and compromise applications.

  • What the Convergence of Observability and Security Means for Devs

    What the Convergence of Observability and Security Means for Devs

    There is a scene in the movie Apollo 13 when the mission control flight director asks why the carbon dioxide scrubber in the command module was a different shape than the one used in the lunar module (and therefore incompatible). The engineer simply replied, “This just isn’t a contingency we’ve even remotely looked at.”

    A similar scenario plays out at many organizations when they examine security and development practices. When it’s time for code to go into production, every developer hopes their code will run as planned–smoothly and error-free. Unfortunately, something will be missed, performance could degrade or new, unanticipated problems can emerge after an application is deployed to production.

    Developers fear the “unknown unknowns.” And it keeps them up at night.

    When an “unknown unknown” problem occurs, it takes time for teams to do the forensics to identify the problem. It can take days or even weeks for teams to complete that initial investigation. If a mission-critical application is offline for a significant period of time due to a forensics investigation, then it can negatively affect your customer’s experience and, ultimately, your organization’s bottom line.

    The “unknown unknowns” problem is another challenge facing developers in today’s unpredictable macro environment. That includes the deluge of data, increasing cyberthreats, an increasingly distributed infrastructure and a remote and hybrid workforce as well as a mix of modern cloud-native and monolithic apps.

    To help developers build for the future and address security concerns, it is imperative they rethink the way they are collecting, operationalizing and storing different types of data from a variety of sources.

    Security and Observability: Better Together

    Today, security and observability have recently begun to overlap, driven by the growing need for organizations to better understand the activity inside their environments. Many forward-thinking organizations are operationalizing the massive amounts of log and event data currently being generated to understand and assess issues in their infrastructure and apps and using these actionable insights to optimize workload, app resource availability, security and uptime.

    So how can developers take advantage of the security and observability convergence trend happening right now?

    Currently, it’s common for developers to have two agents as part of their tech stack. One agent for observability, which is collecting data such as logs and events to get relevant insights into the health and performance of their application in real-time. The other agent is for security to collect data in their devtest, integration and production environments.

    Since these two agents often collect the same data, there is an opportunity to consolidate it into a single location, such as a unified security platform with a single agent, where this data can be overlaid with time series analytics to deliver relevant insights to users. Using this approach of having both security and non-security data in one place will significantly speed up the process of getting these valuable insights into the developer’s hands.

    In addition to getting insights faster, another benefit of having this data in a single location is the ability to access historical data. Giving developers the ability to store and manage data for long periods of time allows them to get insights from this historical data, so they can better understand alerts, incidents and adversaries. This can help them correlate in terms of understanding the risk to an application, such as potential “unknown unknown” threats, which they can proactively address before it causes any damage.

    Adopting a converged security and observability approach is the most mature step that organizations can take to help developers deliver the best outcomes and best experiences for their customers and users. As more organizations rely on the cloud and the speed of business rapidly increases, developers must transform their view of the health, performance and security of applications and infrastructure. Giving developers this perspective will dramatically help them take rapid action against an adverse event before it impacts their company’s bottom line.

  • Survey Surfaces Raft of DevSecOps Cultural and Technical Challenges

    Survey Surfaces Raft of DevSecOps Cultural and Technical Challenges

    A global survey of 606 IT, security, application development and DevOps decision-makers found that the biggest barrier to adoption of DevSecOps best practices is cultural rather than technical. However, the survey, which polled organizations with more than 500 employees and was conducted by Progress, also found only 16% of respondents planned to prioritize addressing those cultural issues in the next 12 to 18 months.

    A full 71% of respondents cited culture as the biggest barrier to DevSecOps progress, with only 30% expressing confidence in the current level of collaboration between security and application development teams currently being achieved. In contrast, 46% of respondents were not particularly confident while nearly a quarter (24%) were not at all confident.

    Nevertheless, well over half of respondents (57%) said security threats are the number-one technology factor driving the evolution of DevSecOps, even though just over half (51%) admitted they were only somewhat familiar with how security fit into a DevSecOps workflow.

    Overall, 86%of respondents said they are experiencing security challenges that include prioritizing externally facing applications over internal applications (47%), securing different types of workloads that were using different development and delivery methodologies (46%), meeting delivery deadlines (45%) and meeting audit requirements specified by the security team (39%). Just over three quarters (76%) recognized they could be more strategic in managing DevSecOps.

    The top three initiatives needed to support a shift to a more strategic DevSecOps approach identified are more investment in continuous learning for developers and engineers (61%), upskilling of developers and engineers to move into site reliability engineering (SRE) roles (60%) and improved communication between developers, security and operations (60%).

    Survey respondents also identified a need to define a clear set of policies and procedures (66%), define the role and responsibilities of staff across teams (62%), create a continuous feedback loop (49%) and automate recurring security tasks (41%).
    Despite that level of awareness, however, only 40% said they believed implementing security training and upskilling efforts across multiple stakeholders was very important when implementing DevSecOps.

    Prashanth Nanjundappa, vice president of product management for Progress, said given all the cultural and technical challenges organizations face, it’s apparent that both a top-down and bottom-up approach to implementing DevSecOps best practices is required. Attempting to shift responsibility left toward application development teams is not going to suffice on its own, he noted.

    The survey also suggested that many organizations are trying to address application security issues as they modernize their application portfolio. A total of 59% said they struggled to attain buy-in/funding for refactoring efforts that didn’t provide new user capabilities. However, only 39% said they had adopted a comprehensive modernization approach based on cloud-native architecture principles, while another 22% felt they lacked one entirely. Just under a quarter (24%) said their approach to modernization is to largely rip-and-replace applications.

    The top business factor driving the adoption of DevSecOps was a focus on business agility enabled by fast and frequent delivery of application capabilities (59%). Just under half (45%) said it had taken six to 12 months to achieve a return on DevSecOps investments, while 31% said it had taken longer than a year. However, only half (50%) of respondents were familiar and interested in both infrastructure and policy-as-code.

    There is no doubt that the DevSecOps journey ahead will be long and arduous. However, there are also a wide range of small process changes that could have a massive impact in terms of improving application security in the short term. The challenge is to quickly identify those opportunities while at the same time employing a more systematic approach that ultimately makes it a lot simpler to implement a set of DevSecOps best practices consistently.