DZone
Thanks for visiting DZone today,
Edit Profile
  • Manage Email Subscriptions
  • How to Post to DZone
  • Article Submission Guidelines
Sign Out View Profile
  • Post an Article
  • Manage My Drafts
Over 2 million developers have joined DZone.
Log In / Join
Refcards Trend Reports Events Over 2 million developers have joined DZone. Join Today! Thanks for visiting DZone today,
Edit Profile Manage Email Subscriptions Moderation Admin Console How to Post to DZone Article Submission Guidelines
View Profile
Sign Out
Refcards
Trend Reports
Events
Zones
Culture and Methodologies Agile Career Development Methodologies Team Management
Data Engineering AI/ML Big Data Data Databases IoT
Software Design and Architecture Cloud Architecture Containers Integration Microservices Performance Security
Coding Frameworks Java JavaScript Languages Tools
Testing, Deployment, and Maintenance Deployment DevOps and CI/CD Maintenance Monitoring and Observability Testing, Tools, and Frameworks
Culture and Methodologies
Agile Career Development Methodologies Team Management
Data Engineering
AI/ML Big Data Data Databases IoT
Software Design and Architecture
Cloud Architecture Containers Integration Microservices Performance Security
Coding
Frameworks Java JavaScript Languages Tools
Testing, Deployment, and Maintenance
Deployment DevOps and CI/CD Maintenance Monitoring and Observability Testing, Tools, and Frameworks
  1. DZone
  2. Software Design and Architecture
  3. Security
  4. AppSec Key Elements

AppSec Key Elements

The keys to application security are visibility and having a holistic security mindset throughout the entire application lifecycle.

Tom Smith user avatar by
Tom Smith
CORE ·
Aug. 06, 19 · Opinion
Like (3)
Save
Tweet
Share
3.52K Views

Join the DZone community and get the full member experience.

Join For Free

To understand the current and future state of application security, we obtained insights from five IT executives. We asked them, “What are the most important elements of application security?” Here’s what they told us:

  • Visibility is crucial; if you can’t see what’s going on, you don’t know where to act. This is why our perspective inside the application is so crucial.
  • Have empathy for the developer. 80% of our companies are developers. Remember what developers have to do — make something that’s relevant, useful, popular, with features, scalable, performant, and secure. Start by understanding that developers have a lot on their plate, and think about how to make their lives as easy as possible. Take the AppSec concern. Ensure that it's consumable and actionable by a developer. If you can form the issue as a bug with direction on how to fix the bug, if you create a form like a JIRA ticket, then you’ve gone as far as a security leader to find issues and make it actionable to fix quickly.
  • Application Security improves as you look at your application deliverable from various perspectives. It’s important to shift left so you get feedback on security vulnerabilities as a developer is coding and includes dependencies into their project — this can be done through IDE plugins (like Nexus Lifecycle).

    At the same time, shifting left doesn’t remove the need for centralized static application security testing (SAST) and dynamic application security testing (DAST), since these techniques can bring different violations to light. Monitoring for attacks in production is a very useful technique as well, as on average, companies take about 197 days to identify and 69 days to contain a breach according to IBM, which clearly shows us that there’s significant room for improvement. New, innovative security solutions even allow you to install agents into the runtime of applications running in production, which monitor critical segments in code and put them in a walled garden, so that even if a malicious user manages to trigger an exploit, they’ll be cut off instantly. The most important element is to not ignore application security completely and to use a multi-perspectival approach since each perspective yields subtly different insights.
  • We have found a holistic security mindset is crucial in every aspect of an application’s development and operation. Continually testing, scanning, and verifying applications is the best way to ensure their secure operation.

    Two are tasks: secure the application lifecycle and secure the application operation. The first part is injecting application security in all phases of the lifecycle. We need to test applications at programming and build phases when collecting elements, at deploy, throughout production, and through the decommissioning of the application. It’s all about detecting vulnerabilities. Once it’s up and running, it's less protected. RASP is a technology I defined in 2012. It’s being adopted very slowly, as it requires instrumentation in a runtime environment.

Here’s who shared their insights:

  • Erik Costlow, Developer Relations, Contrast Security
  • James McClay, Product Manager, Cybera
  • Doug Dooley, COO, Data Theorem
  • Joseph Feiman, Chief Strategy Officer, WhiteHat Security
  • Vincent Lussenburg, Director of DevOps Strategy, XebiaLabs
Application security Element

Opinions expressed by DZone contributors are their own.

Popular on DZone

  • Top 12 Technical Skills Every Software Tester Must Have
  • What Was the Question Again, ChatGPT?
  • Continuous Development: Building the Thing Right, to Build the Right Thing
  • How To Get Page Source in Selenium Using Python

Comments

Partner Resources

X

ABOUT US

  • About DZone
  • Send feedback
  • Careers
  • Sitemap

ADVERTISE

  • Advertise with DZone

CONTRIBUTE ON DZONE

  • Article Submission Guidelines
  • Become a Contributor
  • Visit the Writers' Zone

LEGAL

  • Terms of Service
  • Privacy Policy

CONTACT US

  • 600 Park Offices Drive
  • Suite 300
  • Durham, NC 27709
  • support@dzone.com
  • +1 (919) 678-0300

Let's be friends: