AppSec - the Challenge Between Developers and Security
May 07, 2019

Hillel Solow
Protego

When Billy Joel wrote, "the good old days weren't always good, and tomorrow ain't as bad as it seems," it sometimes feels like he was talking about application security. Spending time with our customers has been illuminating both in how much has changed as they have moved to the cloud, and how much has stayed the same. I think the single most profound struggle and opportunity in application security is the relationship between developers and security.

For the most part, security professionals see developers as unreliable children running with scissors. Conversely, developers see security professionals as antiquated whistleblowers who focus solely on their own job security. Developers, on the one hand, try to ignore or bypass security controls as much as possible. On the other hand, security tries to avoid the actual application while securing it; they will put a Web Application Firewall (WAF) in front of it, some endpoint security or RASP technology below it, and maybe a database firewall behind it.

The good old days definitely aren't all that good in this context. The move to cloud-native spotlights this, both because developers are empowered AND expected to move faster. As well, developers' scissors are getting sharper, with more control over security configuration, and fewer control points between them and production. The sec/dev divide has been a problem for years, but it's pretty much an untenable solution in cloud-native.

This begs the question: how do we make tomorrow better? Let's look at both sides of the equation, starting with security.

Security

First, security needs to understand applications. In a world where applications comprise code, API, and configuration, security can't work blindly without knowing what the code wants to do.

Second, security needs to automate everything. This might not be immediately obvious, but the most valuable aspect of cloud-native development is feature velocity. Developers can deploy new functionality to customers in a matter of hours. The last thing security should be doing is slowing this process down. The only way you can do more security, more frequently, much faster, is if you rely on automation to make the most of your decisions, while you handle the policies and the exceptions.

Third, security needs a combination of guard-rails and paved roads. Security always loves guardrails — such as IAM or endpoint policy enforcement — and in a world where developers own more and move faster, guardrails are ever more important. At the same time, security needs to recognize that guardrails usually get in the way, and developers are primed to surmount obstacles. So guardrails should be your last line of defense, and like in Disneyland, you should pretty much never see them unless you do something stupid. Rather, security should focus on providing developers with paved roads — easy design patterns and tools that make security the path of least resistance.

Developers

Now that we've looked at the security side, what about developers? How does their role change in this new world?

Developers need to recognize that with great power comes great responsibility. Moving at the speed of cloud-native will require them to make time and place for security in their processes.

First, developers and DevOps engineers should encourage security to enable security assurance within the pipeline. Rather than resist security assurance, developers should encourage and embrace processes that will highlight security issues early and in context, where they can be remediated with little cost.

Next, developers should find ways to communicate with security around what their code does and needs. The better security can understand the needs of the application, the more quickly they can empower the developer while still minimizing attack surfaces.

Finally, developers should embrace tools and processes that help them get more for less. Tools that generate least privilege IAM roles, and processes that ensure the use of the latest and greatest patched libraries, for example, can provide a huge boost in security without taxing developers heavily in precious time.

Finding Balance

The key insight I have come to realize is that the balance has shifted — in both directions. Developers have more security responsibility than ever before, and security has the inherent need to understand application code and behavior in ways they might be able to avoid in the past. Achieving equilibrium in the cloud-native world requires both sides to have much more empathy and understanding of the challenges and limitations of the other's world.

At the same time, we need to resist the urge to just make it the other guy's problem. Security needs to own responsibility to ensure the products are deployed and operated securely. Developers need to own the responsibility to have tools, education, and processes in place to meet their security goals.

What gives me cause for optimism is that, more than ever before, we all have a clear shared goal, and if we shed some of our baggage and embrace rather than resist, we might just make things a whole lot better tomorrow.

Hillel Solow is CTO and Co-Founder of Protego
Share this

Industry News

February 26, 2020

Perforce Software released a free tool for organizations considering open source software - OpenLogic Stack Builder.

February 26, 2020

Applause announced a new partnership with Infosys to provide broader end-to-end digital experience testing services to clients.

February 26, 2020

RapidMiner announced the release of its platform enhancement, RapidMiner 9.6. This update prioritizes people – not technology – at the center of the enterprise AI journey, providing new, unique experiences to empower users of varying backgrounds and abilities.

February 25, 2020

JFrog announced the availability of the "JFrog Platform," a hybrid, multi-cloud, universal DevOps platform.

February 25, 2020

Nureva added new agile canvas templates to Span Workspace, including a heat map developed by Jeff Sutherland, the co-creator of Scrum and founder of Scrum Inc. and Scrum@Scale.

February 25, 2020

Agiloft announced the addition of its new Agiloft AI Engine, complete with prebuilt AI Capabilities for contract management and an open AI integration that allows customers to incorporate custom-built AI tools into the no-code platform.

February 24, 2020

Cloudify announced that its latest product update - Cloudify version 5 - features an Environment as a Service component, designed to achieve consistent delivery and management of hybrid-cloud services and network infrastructures across CI/CD pipelines - at scale.

February 24, 2020

Checkmarx announced new enhancements to its Software Security Platform to empower more seamless implementation and automation of application security testing (AST) in modern development and DevOps environments.

February 24, 2020

Rapid7 and Snyk announced a strategic partnership to deliver end-to-end application security to organizations developing cloud native applications.

February 20, 2020

The American Council for Technology and Industry Advisory Council (ACT-IAC), the premier public-private partnership dedicated to advancing government through the application of information technology, officially announced the release of the DevOps Primer.

It was produced through a collaborative, volunteer effort by a working group from government and industry, hosted by the ACT-IAC Emerging Technology Community of Interest (COI).

February 20, 2020

DLT Solutions, a subsidiary of Tech Data, launched the Secure Software Factory (SSF), a framework that provides the U.S. public sector with consistent development and deployment of high-quality, scalable, resilient and secure software throughout an application’s lifecycle.

February 20, 2020

Netography announced the general availability of the company’s Security Operations Platform.

February 19, 2020

Perfecto by Perforce announced its integration with Katalon Studio.

February 19, 2020

Radware announced the Alteon Cloud Control as part of its Alteon Multi-Cloud Solution designed to simplify the deployment of secured application delivery services across public and private cloud environments.

February 19, 2020

BluBracket introduced its product suite, a comprehensive security solution for code in the enterprise.