Three Effective Ways to Make Application Security Testing a Successful Part of Your DevOps Program
From the latest agile development tools to innovative delivery platforms such as containers, DevOps is changing how people and businesses work.
But the novel software development approach of DevOps can also result in unique challenges, one of the most significant of which is application security testing. How do you balance the need for quick software releases while protecting sensitive customer and company data?
Marrying DevOps and Application Security Testing
As DevOps transforms the way software is developed and delivered, it requires a fresh look at application security. IBM and Black Duck Software are pleased to provide you with our recommendations below.
Recently, we hosted a webinar that outlined the unique application security challenges posed by DevOps and simple steps organizations can take to properly address them. Three of the key steps were to start with automation, customize security gates and test for vulnerabilities.
Starting With Automation
The world of DevOps is agile and fast-paced. To avoid slowing down the process, security testing must be automated within the DevOps environment. A great place to start is by integrating application security testing with continuous integration toolsand running your testing at the exact point it’s needed. This enables your DevOps environment to hum along while protecting applications from potential vulnerabilities.
Customizing Security Gates
No two DevOps processes are alike; each application you build has unique development and security needs. Internally facing applications may require less stringent application testing than externally facing ones. In addition, you may be using containers like Docker to deploy your applications.
Know who your applications will serve and the level of data sensitivity associated with each application, and then determine how they’ll be delivered. This will enable you to design the proper application security testing gates at the right points in the DevOps process.
Testing (and Retesting) for Custom and Open Source Vulnerabilities
Applications are increasingly a mix of custom and open source code. Be sure your DevOps and application security teams are testing for both kinds of security vulnerabilities. This means deploying the proper dynamic analysis security testing (DAST), static analysis (SAST), interactive analysis (IAST) and open source (OSS) application security testing tools as part of your DevOps process. In addition, be sure to implement continuous testing to uncover new vulnerabilities as they’re reported.
These three simple steps will have your organization well on its way to making application security a successful component of your DevOps environment.
Source | SecurityIntelligence
