Application Security in United States

Training

Many universities don't include courses on secure software development as part of their curriculum, which causes many developers in practice to learn about it when working for companies with code security requirements. Avoiding risks in early development stages is a practice known as "shifting security to the left" (Shift security to the left) because it's the most cost-effective way to reduce the costs associated with fixing vulnerabilities.
The premise is simple: it's cheaper for vulnerabilities to never be introduced into the code than to detect them with tools, create tickets, develop fixes and test them involving many people in the process.

A good course should be based on respected industry standards such as OWASP's Application Security Verification Standard (ASVS) for web applications or the similar OWASP standard for mobile applications (MASVS).

Secure SDLC

The Software Development Lifecycle (SDLC) should incorporate security practices such as:

• Use a secure development standard to define clear acceptance criteria.
• Code reviews for pull requests considering security criteria.
• Scanning tools for source code.
• Security review of dependencies.
• Dynamic scanning for web applications.
• Unit testing with security validations.
• End-to-end (E2E) testing with security validations.
• Version certification for major releases.

It may seem like a challenge at first, which is why it's recommended to establish a strategy based on an existing framework such as the Software Assurance Maturity Model OWASP SAMM which allows establishing tasks and priorities in a roadmap that facilitates implementation.

Vulnerability Scanning Tools

There are various tools for vulnerability detection that allow providing different security coverage without one being a replacement for another:

• SAST: Static Application Security Testing analyzes source code to detect insecure patterns directly in application code.
• DAST: Dynamic Application Security Testing emulates attacker behavior by interacting directly with a functional application for Web or Mobile environments.
• IAST: Interactive Application Security Testing for Web or Mobile Applications, along with RASP, were variants of DAST that emerged to detect threats combining the application interface with framework integration at runtime.
• SCA: Software Composition Analysis allows searching for vulnerabilities in third-party components to prevent supply chain attacks.
• Container Analysis: Container security scanning allows detecting risks in container construction that may have configuration weaknesses or vulnerable components.

DevSecOps

DevSecOps is the union of Development, Security, and Operations to allow security tools to be integrated into automated continuous integration and continuous deployment (CI/CD) processes.

Vulnerability Management

Generally, development teams already have issue tracking tools, however security teams need visibility and require tools that allow them to measure the status and progress of security according to organizational policies. For this reason, vulnerability management and tracking tools are used to ensure that risks are prioritized and resolved on time according to what is established by company policies or regulations.

Application Certification

Automated tools allow solving vulnerabilities in early stages, however it's usual that a final security verification is needed before a production release, commonly when it's a major version or includes large software changes. Application certification is performed through manual penetration testing (pentest) which allows detecting risks that automated tools may have missed.

The importance of "pentests" lies in the fact that automation can exclude tests that depend on context or specific knowledge of business logic. However, since it's a manual process that takes several weeks, it's usually performed once a year or when significant application changes are made.

Conclusion

Now you know the basics about what AppSec is and some of its processes. Keep in mind that the topic is constantly evolving and new techniques or technologies are being added each day that involve new security processes such as Infrastructure as Code (IaC) or serverless applications.