7 fundamentals of an application security program

2. Start small, plan to scale

This may sound contradictory, but both are important. It’s all about planning for both the short and long-term. Don’t try to boil the whole ocean immediately—prioritize your applications (working through the highly critical applications first), set some measurable goals, and pilot some real activities to generate real results. This will showcase the value of application security, demonstrating a return on investment early and helping with future stakeholder buy-in.

Worthy goals involve reducing risk. It’s not enough to simply find some vulnerabilities. In order to show real improvement, they also need to be remediated. However, it’s also essential to keep in mind that taking steps to secure one application probably isn’t enough. In the long run, you’ll need a risk-based approach to your entire application portfolio. Anything too labor intensive won’t scale well, so keep an eye out for areas to automate and be realistic about the level of detail included.

3. Look at the whole SDLC

Good application security is a holistic property of the application. There is no magic tool that can do it all for you. Much like other areas of quality assurance, the best approach is to combine different activities at different stages of the software development life cycle (SDLC). The areas to consider first are:

• the design phase (with architecture analysis)
• the development phase (with secure code review)
• the deployment phase (with dynamic application security testing)

It’s generally easier to identify issues later in the SDLC (via activities such as penetration testing), but bear in mind that the cost associated with fixing them later in the SDLC is also higher.

Aim to identify issues at the earliest opportunity.  Earlier detection will reduce the cost to fix the issue, and will reduce the time pressure on the developers and other implementing teams (not to mention that this could also avoid bad PR for the application security process). One of the most satisfying parts of my job is finding issues before they even become issues (perhaps in a conversation with the architect before they have even put pen to paper).

4. Leverage existing strengths of your organization

There is no one correct way to build an application security program. The most efficient way is to leverage existing processes and capabilities in your organization as much as possible. Does your organization have strongly enforced SDLC quality gates? Add some application security activities to them. Does development revolve around the CI toolset? Integrate some security tooling into it. Does your development team manage their time via JIRA tickets? Make sure you raise JIRA tickets for security bugs.

5. Shout about it

Application security is interesting! Take as many opportunities as you can to ‘spread the good word.’ It’s important to educate your stakeholders, but if you really grab their interest they might start to educate themselves and truly embrace your ideas. It’s great to show off any vulnerabilities you find in your applications, just be careful not to bruise any egos in the process.

6. Be an enabler

Application security needs to be seen in a positive light. Don’t just highlight problems, propose solutions! If you know your organization and/or coding languages and frameworks well, you might know a better way to do things that will save time for the implementing teams. Educate your stakeholders as you go. Make sure they know how to avoid similar issues in future, encouraging a more efficient and effective process.

Sometimes a compromise is required when conflicts arise. Avoid allowing application security to gain the reputation of ‘blocker’ or to cry wolf at any opportunity. That’s a sure fire way to make people avoid it!

7. Build a knowledge base

There will be many interesting bugs and flaws along the way, and you are likely to encounter some of them more than once. Once you’ve fixed something, keep a record so it can be fixed more easily next time. If you spend a lot of time getting an authentication system right, encourage its reuse within the organization. If you find a great resource online, bookmark it in a shared location so that others can read it too.