How to Build a Feedback Loop That Narrows the Gap Between Development and Security
September 23, 2021

Lebin Cheng
Imperva

There's a tug-of-war happening between the development operations team (DevOps) that's responsible for building the company's innovations and the security operations team (SecOps) that's tasked with keeping everything protected.

The growing proliferation of application programming interfaces (APIs) is further exacerbating the tension between these functions. On one side, you have SecOps teams, who have a difficult time gaining visibility into API transactions as API schemas are often lightly documented and subject to frequent changes. While on the other side, there are DevOps teams, who need the freedom to rapidly adjust APIs to meet changing business needs without the burden of manually updating API specifications for security testing and policy definitions.

Although the SecOps team wants to keep a watchful eye on the behaviors of the dozens or hundreds of APIs operating within their network, today's conventional API security methods slow DevOps and make the organization less efficient.

As the connective tissue that binds modern, cloud-native applications together, APIs are essential; but, they're also introducing more cybersecurity risk to the organization. By 2022, it's predicted that APIs will become the most frequently attacked enterprise web application vector.

To fully realize a successful approach to development security operations (DevSecOps) for API security, creating an effective feedback loop between DevOps and SecOps teams is critical to getting a grasp on API security risks.

Establishing a Feedback Loop that Discovers, Monitors and Secures APIs

Historically, applications were deployed under the assumption they would be protected by the network perimeter. As modern software development moves into cloud-native environments, this traditional concept is less effective and leaves the process exposed to additional security vulnerabilities.

By establishing and implementing a feedback loop between DevOps and SecOps, organizations can streamline application release workflows and enable developers to focus on delivering an optimal digital experience while providing the SecOps team with visibility and control over the application runtime.

The ideal feedback loop should encompass three critical domains: discovery, monitoring and security.

Discovery: Maintain an always up-to-date API inventory with contextual data labels. Ideally, this should be done autonomously with an unobtrusive solution that continuously keeps the API inventory up-to-date with data security classifications. For some, discovery simply entails mapping API service endpoints, but that's not enough. Instead, you need to know what data each API is accessing — and shift to a data-centric approach to API security.

Monitoring: Generate developer-sourced specifications and check against security best practices. Functional or regression testing is monitored to validate specifications or to generate specifications if they're not available. Enabling automation ensures protection can keep pace with application changes without manual intervention. That way, new APIs discovered during runtime are checked in the next cycle while API calls in testing help prepare the runtime model.

Security: For API-first apps, API specification is always completed and updated before actual implementation. For other applications, API specification can be used as a reference, but dynamic discovery is needed to ensure the actual implementation and API specifications are in sync. This also means that stringent positive enforcement is not possible. An automated learning system is needed to build a new baseline every time a new API specification is discovered or updated. The new baseline helps to identify anomalies accurately and drive security policy actions without manual intervention.

This feedback loop gives the SecOps team the visibility they need into potential threats without slowing down the development process. It's analogous to adding a security camera to monitor the production floor of a warehouse. The SecOps team gets visibility around-the-clock, monitors for suspicious activity and can react as soon as something nefarious happens. In a software production environment, AI and machine learning are essential for helping automate this activity and to reduce the time it takes to respond.

What's Needed Longer Term

The idea behind a development security operations (DevSecOps) process is sound, but the approach is often flawed because these two functional departments cannot simply be locked in the same room and expected to exist symbiotically.

Both DevOps and SecOps want a frictionless relationship where developers are enabled to move fast and innovate the business, without putting it at risk. However, both sides lack the tools needed to monitor what's happening in development and production — particularly the API calls between internal and external applications and services.

Through the implementation of the API discovery and risk assessment feedback loop, organizations can successfully streamline the resources needed to manually fill the gap while mitigating security risks.

Lebin Cheng is Head of API Security, Office of the CTO, at Imperva
Share this

Industry News

November 30, 2023

Parasoft, a global leader in automated software testing solutions, today announced complete support for MISRA C++ 2023 with the upcoming release of Parasoft C/C++test 2023.2.

November 30, 2023

Solo.io achieved the Amazon Elastic Kubernetes Service (Amazon EKS) Ready designation from Amazon Web Services (AWS).

November 29, 2023

CircleCI implemented a gen2 GPU resource class, leveraging Amazon Elastic Compute Cloud (Amazon EC2) G5 instances, offering the latest generation of NVIDIA GPUs and new images tailored for artificial intelligence/machine learning (AI/ML) workflows.

November 29, 2023

XM Cyber announced new capabilities that provide complete and continuous visibility into risks and vulnerabilities in Kubernetes environments.

November 29, 2023

PerfectScale has achieved the Amazon Elastic Kubernetes Service (Amazon EKS) Ready designation from Amazon Web Services (AWS).

November 28, 2023

BMC announced two new product innovations, BMC AMI DevX Code Insights and BMC AMI zAdviser Enterprise.

November 28, 2023

Rafay Systems announced the availability of the Rafay Cloud Automation Platform — the evolution of its Kubernetes Operations Platform — to enable platform teams to deliver automation and self-service capabilities to developers, data scientists and other cloud users.

November 28, 2023

Bitrise is integrating with Amazon Web Services (AWS) to provide compliance-conscious companies with greater access to CI/CD capabilities for mobile app development.

November 28, 2023

Armory announced a new unified declarative deployment capability for AWS Lambda.

November 27, 2023

Amazon Web Services (AWS) and Salesforce announced a significant expansion of their long standing, global strategic partnership, deepening product integrations across data and artificial intelligence (AI), and for the first time offering select Salesforce products on the AWS Marketplace.

November 27, 2023

Veracode announced product innovations to enhance the developer experience. The new features integrate security into the software development lifecycle (SDLC) and drive adoption of application security techniques in the environments where developers work.

November 27, 2023

Couchbase announced a new Capella columnar service on Amazon Web Services (AWS), enabling organizations to harness real-time analytics to build adaptive applications.

November 21, 2023

Redgate announced the launch of Redgate Test Data Manager, which simplifies the challenges that come with Test Data Management (TDM) and modern software development across multiple databases.

November 21, 2023

mabl announced an integration with GitLab, the AI-powered DevSecOps platform.

November 21, 2023

FusionAuth announced the availability of new software development kits (SDKs) that support Angular, React and Vue JavaScript front-end frameworks.