A Practical Approach to Shifting Security Left
February 23, 2021

Walter Capitani
GrammaTech

There are two important considerations when adding security to an existing DevOps pipeline. The first is security in code, which means, when code is developed, the security of the code itself should be continuously reviewed and assessed. The second is security as code, in other words, security requirements need to be part of the process from the beginning. Let's look at both of these concepts in a bit more detail.

Security in Code

Many teams start their path to security off by adopting coding guidelines or standards such as MISRA, OWASP, or the CERT guidelines, which is a great start, it improves code security from the get-go. However, just following a coding standard by itself does not necessarily avoid complex security vulnerabilities. According to a recent study by Microsoft, 70% of today's security vulnerabilities are caused by memory access errors.

Memory vulnerabilities here could be caused by a simple miscalculation, which led to a buffer-overrun-write, or a more complex path where a variable is tainted through input from the outside that is used without being sanitized. To find these problems in the code, more sophisticated analysis is needed such as dataflow analysis and abstract execution provided by advanced static application security testing (SAST) tools.

Equally important is understanding the security implications of the software components your products depend on such as open source, internal reused code and commercial software. Without this, your best efforts will be for naught if vulnerabilities exist in third-party code included in your application.

Software composition analysis (SCA) tools provide a continuous software bill of materials (SBOM) that itemizes all the software libraries in your dependencies and associated known vulnerabilities. This SBOM is established early on in development and is updated continuously as dependencies evolve both from updates and newly discovered vulnerabilities.

Security as Code

An interesting approach that has come out of DevSecOps practice is the concept of treating security in the same ways as code is; guided by requirements, which leads to implementation of security controls, then to validation through testing, and of course, documentation. It's one of the key ways to integrate security into DevOps and a good way to build security into the development culture and have software teams communicate using a familiar language.

Certainly, security implementations that end up as actual code with associated tests can be automated in the same fashion as other code. Automation tools apply here as would any tool that works with requirements, tests, documentation, etc.

Each iteration through a continuous process requires a review which includes the backlog of security issues but also important data on changes needed to security controls and requirements. This feedback into the process is a key and important part of making DevSecOps success — repeat, review and refine.

Integrating SAST and SCA to Shift Left Security

Automation is one of the main tenets of DevOps. Nothing should be dependent on manual steps as they can be easily overlooked, either by accident or by malicious intent. SCA tools can be used immediately to establish a baseline SBOM for the application. Without first understanding the vulnerabilities and risks associated with your software stack, other measures will be in vain.

It's equally important to keep this SBOM up-to-date with each iteration since the threat landscape can change over time as does the composition of the dependencies. Tools that can analyze third-party binaries even if source isn't available, can limit exposures.

SAST is used as soon as code is available in a project and automates the coding compliance and automatic detection of defects and vulnerabilities. In fact, as soon as it's been typed in by a developer — the sooner the better. SAST tools that integrate with popular IDEs can provide immediate feedback in the developer's environment, before it gets committed to the source repository.

SAST comes in all types of shapes and sizes, some focus on coding standards, some, more advanced tools, step beyond the coding standards and explore data flow, control flow and abstract execution techniques to find defects in the source code that arise from programming or logic mistakes. The latter help achieve security in code and assist in creating security as code — by covering coding standards, security control enforcement and vulnerability detection.

Continuous integration and deployment processes rely on automation to realize their promised benefits. Without efficient progress through the cycle, the continuous nature of the processes amplifies inefficiencies. All new code has vulnerabilities, the challenge teams face is to remove these as early as possible with as little effort as possible. SCA ensures the software stack is secure while SAST improves custom code security and quality early in the process and helps developers do this as easily as possible, ideally, integrated into their development environment.

Summary

SAST and SCA tools are an important part of shifting security left because they are used immediately at the early stages of a project. They are also instrumental in helping enforce security controls and coding standards required for the application meanwhile detecting new, possibly complex, security vulnerabilities as they arise. SCA tools ensure the software stack is accounted for with a software bill of materials that show both contents and existing security vulnerabilities in your software dependencies. Over time, these tools are part of the regular part of the team's workflow providing better code but critical data on general progress.

The move to integrating security into an existing DevOps pipeline starts with introducing best practices early in the development lifecycle. SCA and SAST tools are ideal for facilitating this transition. In addition, the feedback to developers and management is crucial in both improving security, and improving the DevOps process in general.

Walter Capitani is Director of Technical Product Management for GrammaTech
Share this

Industry News

March 02, 2021

JFrog announced that its DevOps Platform tools – JFrog Artifactory and JFrog Xray – are available with native deployment templates for customers using AWS GovCloud (US) and Azure Government clouds.

March 02, 2021

Spectro Cloud announced support for existing Kubernetes environments, including clusters on public cloud services such as Amazon EKS, Azure AKS and Google GKE, has been added to the Spectro Cloud Kubernetes management platform.

March 02, 2021

Idera announced the acquisition of PreEmptive Solutions, LLC, a provider of application protection and security.

March 01, 2021

CloudBolt Software announced the launch of OneFuse Community Edition, a free version of its codeless integration platform for automating, integrating, and extending private and hybrid cloud infrastructures.

March 01, 2021

DBmaestro launched support for Snowflake, the Data Cloud company.

March 01, 2021

Platform9 closed Series-D funding with an additional $12.5 million for a total of $37.5 million.

February 25, 2021

Red Hat announced Red Hat OpenShift 4.7, the latest version of the company’s enterprise Kubernetes platform.

February 25, 2021

Granulate announced the release of its open-source platform, the G-Profiler, a production profiling solution that measures the performance of code in production applications to facilitate compute optimization.

February 25, 2021

Checkmarx announced the launch of KICS (Keeping Infrastructure as Code Secure), an open source static analysis solution that enables developers to write more secure infrastructure as code (IaC).

February 24, 2021

Applause launched its Product Excellence Platform (PEP).

February 24, 2021

Mabl announced the beta release of their new native desktop application that empowers users to easily automate testing for browsers, mobile browsers, and APIs.

February 24, 2021

D2iQ announced the general availability of D2iQ Kaptain, the cloud native end-to-end platform for running ML workloads on Kubernetes.

February 23, 2021

Edge Delta announced new capabilities for dynamically processing and routing logs, metrics, and traces -- allowing DevOps, Security, and SRE teams to analyze large volumes of streaming data without the cost, delay, or complexity of requiring data to be indexed, helping customers decouple where machine data is analyzed from where it is stored.

February 23, 2021

env0 announced a remote run SaaS solution for the automation of Terragrunt workloads across multiple Terraform modules.

February 23, 2021

Platform9 closed its Series-D funding with an additional $12.5 million for a total of $37.5 million.