AppSec best practices for security that sticks

New year, new AppSec program. 

Just like any good resolution, AppSec that makes a lasting impact is one you have to stick to, fine-tune, and hold yourself accountable for. AppSec programs act like bumpers in a bowling lane and help keep you on track, but there’s no magic bullet for hitting your target. That’s where making small, smart adjustments through best practices and using integrations to automate more tedious processes adds up to impactful and measurable results. 

If we want to keep up with the ever-expanding web attack surface, this change is more important than ever. In 2010, there were just over 206 million registered websites, but today there are more than 1.9 billion, and those websites rely on components and integrations galore. Threat actors have more opportunity than ever to access personal information, find backdoors, and break through flimsy security protocols or legacy systems to access the data we use every day. 

Through a careful and tunable approach to AppSec, safeguarding your web applications isn’t just a daydream – it’s an attainable resolution for 2022 and beyond. Let’s take a look at some of the most critical AppSec best practices that can help your team of developers and security professionals succeed. 

AppSec knowledge gaps? OWASP to the rescue

Building an AppSec program that actually does what it’s meant to do is kind of like building a house. A lack of sturdy, foundational knowledge can lead to leaks and cracks in your security posture. Factor in that 70% of teams skip critical security steps in the midst of an already glaring cybersecurity skills gap, and we’ve got a problem. 

When you don’t know where to begin, look to the experts. The Open Web Application Security Project, or OWASP for short, has been around since 2001 and provides a wealth of resources that aim to improve the state of web security. They focus on some of the most common and exploitable flaws and code problems, including input validation, access control issues, and subpar cryptographic practices – all critical, foundational knowledge for security-conscious developers. 

We aim to stay on top of OWASP’s updates so that we’re aware of shifts and trends for top security risks, but also because OWASP offers value beyond the most common flaws and coding issues. Guidance for AppSec success includes:

• Defining roles and responsibilities for DevSecOps
• Understanding how effective your controls and procedures are
• Setting security and verification standards for outsourced development

Once you have your foundation, building the walls and roof is less daunting. Take advantage of resources available from industry stewards, and use them as a launching point to build a strategy for your security posture. 

Sanity-savers: Integrate, automate, and update 

Knowing which common vulnerabilities and security pitfalls to look out for is only scratching the surface. If you want these moving pieces to work seamlessly like cogs in a machine, your AppSec program needs to be scalable, flexible, and agile, fitting into existing workflows to match your organization’s speed of innovation.  

That’s where accurate automation comes in. It can help with ease of use, assists with finding more vulnerabilities faster, and verifies results to reduce time-consuming second guesses. Opt for a scanning tool with automation as a foundational feature so that you can scan hundreds or even thousands of web assets without manual configuration pumping the brakes on efficiency. If you can eliminate bottlenecks through automation and integration and reduce tension between development and security, sanity is easier to maintain.

Full integration of AppSec should include dynamic testing (DAST) alongside interactive testing (IAST). Critical for probing the application’s attack surface through the eyes of a bad guy, DAST scans your entire application as executed, covering both your custom code and external dependencies or components so that you have maximum visibility. And if your DAST tool of choice is fast and integrated with your existing development toolset, you can address security defects as a matter of course without missing those important development deadlines.  

A well-rounded AppSec program covers every corner of your application, prioritizing asset discovery so that you know what you have in your environments and what carries the greatest risk. It is also agile and flexible, allowing you to quickly find what needs updating and keep everything secure. By covering more ground and scanning early and often, your team of developers and security pros will have more confidence in the code they’re pushing out – and you’ll have more peace of mind that your data is secure. 

Keep your eye on the prize and kick false positives to the curb

Numbers talk, and they say the threats are bigger than ever: 2021 set a new record for the number of exploitable flaws out in the wild. And because threats are always agitating the security seas, progress monitoring matters a lot. If you don’t know how well your program is performing, it’s impossible to pivot and improve. One of the most critical pieces of the puzzle is reporting that will keep you honest.

Tools that offer built-in reports mean you have an in-depth view of your security posture across websites and applications. They ensure you’re not only meeting internal goals, but also that, if need be, you’re satisfying government-level compliance requirements like DISA STIG. 

AppSec best practices should also consider pesky and time-consuming false positives that lead to undue frustration for developers and security professionals. Automated confirmation features like Proof-Based Scanning cut out the manual verification process entirely by safely exploiting many direct-impact flaws and providing proof right in the scan results. That’s time and brainpower saved for more pertinent projects. 

Helping security and development find harmony

Perhaps one of the biggest challenges in AppSec is one that still makes waves even with all of the right tools and procedures in place: DevSecOps enablement. Enablement is all about alignment and keeping your goals in view as you implement your strategy. Continuously monitoring your program will help you spot the problems that are holding your team back from effective cross-functional efforts. Ignoring these bottlenecks in collaboration leads to dysfunction in the development process, ultimately impeding security and taking your program back a step.

So, where to begin? It starts with communication. Let’s face it, developers and security experts don’t speak the same language, and that can cause misunderstandings across the board. It’s even a source of animosity for some teams, though we think the tide is turning there – 76% of respondents to our recent research report noted that developers and security professionals are able to work well together on security issues. Only 17% described their counterparts as “frenemies” and “strangers.”

By harmonizing these two sides of the aisle and giving both teams the opportunity to succeed, you’re able to solve more pain points and kick your security posture up a notch. Have your developers scrum with their security counterparts so that they learn each other's processes and workflows, then use that knowledge to create policies that will solve roadblocks and help you hit your KPIs. 

But most importantly, make sure these security-minded messages and best practices come from the top down. An effective AppSec program that permeates the entire organization starts with leadership but is backed by an intelligent strategy, modern tools, and enablement opportunities. 

Flipping the switch on shoddy AppSec 

With many moving pieces in the development process comes great security responsibility. Part of being on the frontlines of security is staying agile and knowing when to pivot your strategy so that you’re ready to face the next big threat. It’s not easy, but with best practices in place – and the right crew steering the ship – there is real progress to be made. 

Once you have a handle on skill gaps and developer know-how, focus on bridging gaps in communication and collaboration. With those two bottlenecks out of the way, it’s much easier to adopt modern tooling, integrations, and features that keep everyone on the same path towards a well-oiled AppSec machine. 

Read our essential guide to learn more about building an effective web application security program without compromises.