DevSecOps Begins at the Application Layer
February 19, 2019

Brian Jenkins
StrongKey

In the fast-moving world of DevOps, security sometimes got left by the wayside on the way to the next iteration. But today's threat landscape is so perilous that developers need to have solid security top of mind as they design and build applications. This includes features like user authentication, digital signatures, and encryption.

Learning from Insecurity at Uber

Uber's operating procedures provide many cautionary tales, but this one gives a vivid description of why security is needed at every level and what can go wrong if it is not in place. An Uber software developer stored a service credential in application code to access sensitive information from the database. He then stored the code in a private repository in GitHub.

Including service credentials – a "shared secret" – inside software would, in itself, have been a violation of security best practices, since these can be compromised in many places besides the GitHub repository. This would include testing environments, staging machines and, of course, the production infrastructure itself.

Here's the rub: GitHub wanted software developers to protect their repositories from unauthorized access, so it had already implemented FIDO-based strong authentication. Despite the deployment of one of the strongest authentication protocols in the industry, GitHub neither encourages its users to sign up nor sign in with FIDO technology. Consequently, the Uber software developer used one or more shared secrets – username/password, one-time passcodes, etc. – to authenticate to the Uber repository.

But wait – there's more. Uber also automatically deployed its applications into Amazon Web Services (AWS) using yet another shared secret: an application programming interface (API) key with a secret key – in other words, a username and password.

The result was a perfect storm of insecure practices: using passwords to store software in a repository, containing passwords to access a protected database, using passwords to automatically deploy applications into the public cloud. It all eventually led to the compromise of sensitive data. Uber suffered a breach of 57 million passenger and driver records in 2016.

Security at the Application Level

This story included many security faux pas, but malicious actors only need to find one. FIDO's multiple uses make it an ideal security option. Though FIDO protocols were primarily designed to enable strong authentication to web applications, they can also support transaction authorization. Sadly, as noted above, organizations are apparently not using either feature in any consistent, meaningful way.

This leads to unnecessary losses. FIDO protocols not only have the potential to strengthen transaction security, but they eliminate the password nightmare that end-users go through while protecting them and web applications from many attacks on the internet.

Ransomware is a prime example of why organizations need application security. Such attacks work because applications allow authenticated users to modify files – encrypting them and deleting the original file – without secondary authentication and/or authorization. Consequently, malware executing on users' computers do so with full privileges of the user. FIDO digital signatures change that framework, leading to higher levels of security.

An additional security measure at this point is transaction-level authorization to not only deter transaction fraud but also to protect against ransomware. The protocols are available today; the tools are available now. All that is required is the resolve to implement these measures.

Laying a Secure Groundwork

One of the reasons bad actors continue their successful streak of data breaches is that organizations are still operating on the mistaken assumption that it is easier to deter "barbarians at the gate" than to protect sensitive data in the application. As a result, companies over-invest in network-based security tools – firewalls, anti-virus, malware detection, intrusion prevention, etc. – rather than also invest in the control mechanism that provides the highest level of data-protection: application-level encryption.

By adding application-level encryption from the ground up, software developers serve their users well. While some risk can be reduced by using FIDO-based strong authentication controls, reasonable data security requires multiple controls to deter attackers – a practice the security industry terms as "defense in depth."

The most secure data protection a company can hope to implement, without eliminating sensitive data from a system, involves encrypting and decrypting data within authorized applications (combined with a hardware-backed cryptographic key management system). Adding FIDO-based strong authentication creates a high level of risk mitigation. By building these security measures in from the start, DevSecOps professionals lay the groundwork for maximum-strength protection where it counts most.

Brian Jenkins is VP of Product at StrongKey
Share this

Industry News

June 01, 2020

IT Revolution announced a full conference agenda for DevOps Enterprise Summit London, June 23-25, 2020.

June 01, 2020

Caltech CTME announced that Simplilearn, a global provider of digital skills training, will collaborate with CTME (Caltech's Center for Technology and Management Education) to offer a specialized Post Graduate Program in DevOps software engineering.

June 01, 2020

DevOps Institute, a global member-based association for advancing the human elements of DevOps, announced the introduction of its SKILup Playbook Library, a dynamic collective body of knowledge (cBok) that aligns thought leadership from industry experts with a set of dynamic, orchestrated artifacts, research and assets.

May 28, 2020

Docker has extended its strategic collaboration with Microsoft to simplify code to cloud application development for developers and development teams by more closely integrating with Azure Container Instances (ACI).

May 28, 2020

Eggplant announced updates to its Digital Automation Intelligence (DAI) platform.

May 28, 2020

Aptum launched its Managed DevOps Service in partnership with CloudOps, a cloud consulting and professional services company specializing in DevOps.

May 27, 2020

Red Hat announced an expansion of its application services portfolio with the addition of Quarkus as a fully supported framework in Red Hat Runtimes.

May 27, 2020

Couchbase has completed a $105 million all-equity Series G round of fundraising.

May 27, 2020

Aqua Security closed a Series D round of $30M led by Greenspring Associates.

May 26, 2020

GitLab is releasing 13.0 of its DevSecOps platform to enable organizations to efficiently adapt and respond to new and dynamic business challenges.

May 26, 2020

Solo.io announced the availability of the Istio Developer Portal to streamline the developer onboarding process for improved developer experience and increased productivity with added security features.

May 26, 2020

WhiteHat Security will offer free application scanning services to any education institution to support secure online learning.

May 21, 2020

Exadel announced the Grand Prize winner of the “Appery.io COVID-19 Virtual Hackathon.”

May 21, 2020

CloudBees announced significant advances for its Software Delivery Management (SDM) platform – integrations with additional continuous integration and continuous delivery (CI/CD) engines, including Google Cloud Build and Tekton, and extension of the availability of CloudBees’ SDM Preview Program.

May 21, 2020

OutSystems is announcing over 70 development accelerators that ensure web and mobile applications created on the OutSystems low-code development platform can comply with the highest accessibility standards and regulations.