Inside AppSec

CISA recently introduced binding order 22-01 to remediate known vulnerabilities. The order requires federal agencies to remediate vulnerabilities that are actively exploited, or potentially lose their authority to operate.
We talk with former government service-men and employees to hear about what this means for federal groups.

Forrester predicts that 25% of developers will be using serverless technologies by the end of next year. There are a lot of benefits from serverless applications: faster release cycles, lower infrastructure costs, and improved efficiencies. Yet, at the same time, organizations are running into application security roadblocks. Legacy application security tools simply cannot scale or keep pace demanded by serverless applications. In response, Contrast just released Contrast Serverless Application Security, which automatically detects security vulnerabilities directly within serverless environments. This empowers developers to quickly validate and prioritize test results for remediation. Contrast’s Head of Cloud-native Security Research Tal Melamed and Director of Product Marketing Blake Connell sat down with the Inside AppSec Podcast team to discuss this new product and what differentiates it from current application security approaches on the market.

Episode #57 Key Takeaways From a New Serverless Application Security Report 

Software development is a core component of digital transformation, and the use of serverless technologies is helping to accelerate release cycles to new heights. A panel of serverless application security experts discuss key findings and insights from a new survey report on serverless application security in this Inside AppSec Podcast. The moderated discussion touches on topics such as the current and future outlook of serverless applications, the top application security challenges organizations face in embracing serverless applications, serverless application security best practices and benchmarks, and much more.

Episode #58 New Serverless Application Security Solution Is a Transformative Breakthrough 

Contrast Labs was a fledgling organization just a few years ago when Contrast’s CISO David Lindner took on the mantle of leadership. Today, Contrast Labs is a pivotal linchpin—threat modeling to protect Contrast’s network, applications, users, and data from malicious attacks, providing engineering with product ideas, overseeing product bug bounty programs, and competing in capture-the-flag (CTF) events. In addition to discussing each of these topics, Lindner explains how his team has partnered with marketing to generate data-driven bimonthly and annual reports that customers and prospects use to benchmark their application security programs. He also provides his insights on the role of the CISO in the application security space.

2021 Application Security Observability Report
Checklist: 4 Ways To Boost Application Security This Month

Cybersecurity adheres to the belief that the more results you can generate, the better your security model. This is certainly true in the application security space, where the more alerts that are generated, the better an organization's security posture. But this isn't necessarily true. In this Inside AppSec Podcast interview, Contrast's Chief Scientist and Co-founder Arshan Dabirsiaghi and Head of Product Marketing Mahesh Babu discuss why this belief is so firmly entrenched in the application security space and why less is actually more. The interview also touches on Contrast's pipeline-native static analysis tool (Contrast Scan) and how it turns legacy static scanning models on their head to produce faster scan results and dramatically greater accuracy with significant improvements in operational efficiency.

Blog Posts:
MODERN PROBLEMS: TRADITIONAL SECURITY SCANNING WASN’T BUILT FOR TODAY’S PIPELINES https://www.contrastsecurity.com/security-influencers/modern-problems-traditional-security-scanning-wasnt-built-for-todays-pipelines

CONTRAST ANNOUNCES THE FIRST BREAKTHROUGH IN SAST IN 15 YEARS https://www.contrastsecurity.com/security-influencers/contrast-announces-the-first-breakthrough-in-sast-in-15-years

White Paper: WHITE PAPER: PIPELINE-NATIVE SCANNING FOR MODERN APPLICATION DEVELOPMENT https://www.contrastsecurity.com/whitepaper-pipeline-native-scanning-modern-application

The 2021 OWASP Top Ten was a huge research and analytical undertaking involving over 500,000 applications and 200 CWEs. The amount of data analyzed was upwards of 4x greater than what was used for the 2017 OWASP Top Ten release. OWASP Top Ten Co-Lead and Union University Professor Brian Glas discusses how the data was compiled and analyzed and how the OWASP Top Ten categories were reevaluated. This in-depth Inside AppSec Podcast interview also examines the rationales behind each of the 10 categories. 

The 2021 OWASP Top Ten contains some significant changes, including several additions. Understanding what changed and why they changed is important for application security professionals. This Inside AppSec Podcast features Contrast Security's CTO and Co-founder Jeff Williams and CISO David Lindner who explore the changes and additions to the Top Ten and how organizations should use the Top Ten to manage their application risks. 

The number of vulnerabilities per application in the May-June Bimonthly Application Security Intelligence Report from Contrast Labs remained flat, but the number of serious vulnerabilities jumped. This Inside AppSec Podcast conversation discusses what vulnerability types saw the biggest increases and which ones are the most concerning. The podcast also covers the latest insights into the Contrast RiskScore and findings on attacks and explores trends per languages during May and June.

The more application security debt an organization carries, the greater the risk and operational inefficiencies. Contrast Security's CTO and Co-founder Jeff Williams and CISO David Lindner reflect on security debt findings in Contrast's 2021 Application Security Observability Report in this Inside AppSec podcast—the first show in a series of three on the report. Areas of discussion include observations on the time required to achieve median time to remediate resolved vulnerabilities and the average amount of time required to remediate a vulnerability (as compared to legacy application security tools). The podcast also covers the newly formulated vulnerability escape rate—the average number of new vulnerabilities introduced over the period of the past year per application—which highlights the importance of just-in-time security learning for developers. 
2021 Application Security Observability Report:
https://www.contrastsecurity.com/2021-observability-report

The percentage of applications with serious vulnerabilities increased significantly over the past year. However, vulnerability prevalence varied across vulnerability type. Knowing which ones are the most prevalent and with the greatest likelihood to impact enables security and development teams to prioritize vulnerability remediation. As developers experience what the two guests—Contrast Security's CTO and Co-founder Jeff Williams and CISO David Lindner—in this Inside AppSec podcast describe as just-in-time security training through real-time, actionable instructions on how to fix vulnerabilities that were introduced into the code, the vulnerability escape rate falls. The two guests also discuss how the RiskScore Index, which catalogs 19 different vulnerability types, enables organizations to pinpoint which vulnerabilities post the highest risk by combining vulnerability and attack data.
2021 Application Security Observability Report:
https://www.contrastsecurity.com/2021-observability-report