Inside AppSec

If anything, the recent software supply chain attacks demonstrate the interconnectivity of modern software and the exponential risk one successful exploit poses to thousands of organizations worldwide. Contrast Security's annual 2021 Application Security Observability Report finds that custom code comprises a substantial percentage of active application code. A large percentage of open-source libraries are inactive, and moreover a majority of classes in active libraries are never invoked. Contrast's CTO and Co-founder Jeff Williams and CISO David Lindner discuss these and other application composition findings and insights in this Inside AppSec podcast.
2021 Application Security Observability Report:
https://www.contrastsecurity.com/2021-observability-report

The March–April 2021 Bimonthly AppSec Intelligence Report from Contrast Labs pegs the overall RiskScore Index at 5.06, the lowest since July 2020. This should be good news, especially with the percentage of applications with a serious vulnerability decreasing in this bimonthly time frame. However, the number of applications with serious vulnerabilities remained higher than any month since November. Further, the percentage of applications impacted by specific attack types increased 9% and attacks on Java applications that were viable were up to 3% of applications—a big jump from .5%. Listen to this Inside AppSec podcast interview with Contrast Security CTO and Co-founder Jeff Williams and Sr. Data Analyst and Scientist Katharine Watson to get more details on these trends and others. 

Contrast Labs’ Director of Security Research Matt Austin discovered a Remote Code Execution (RCE) vulnerability in Microsoft Teams that could have exposed the Microsoft Teams software supply chain to a malicious exploit that could have impacted millions of users and thousands of businesses. Listen to this podcast interview with Matt to find out how he found the vulnerability and worked with Microsoft to confirm it. Matt also discusses how the Contrast Application Security Platform enables organizations to detect supply chain vulnerabilities and block attacks before they can connect with them.

Incumbent legacy static analysis approaches employ large rule sets to look for code quality issues that require lengthy scan processes and generate large piles of findings—many of which are false positives. Contrast Security's Chief Strategy Officer Surag Patel and Sr. Product Marketing Director Mahesh Babu discuss the addition of Contrast Scan to the Contrast Application Security Platform in this Inside AppSec Podcast. Using a breakthrough pipeline-native static analysis approach that uses a demand-driven algorithm, Contrast Scan delivers speed at DevOps scale (10x faster scans and 45x faster vulnerability remediation). Listen to this podcast to get the details on how you can "scale up" your application security. 

Contrast Security’s 2021 State of Application Security in Financial Services Report canvasses a number of topics related to application security in financial services such as how the rapid adoption of DevOps/Agile in financial services is outpacing application security, how application security is inefficient and often slows down release cycles, the amount of time security and development teams spend managing application security, and the risks financial services organizations are facing from application vulnerabilities. This Inside AppSec Podcast with Contrast’s CISO David Lindner and Director of Developer Relations Erik Costlow explores these and other topics in the report. 

The recent Contrast Security 2021 Open-source Security Report reveals real-world (and previously undiscovered) aspects about open-source library usage and the risks associated with it. Legacy approaches to open-source security generate alert noise, struggle to track software licensing risks, and poorly integrate with existing CI/CD processes and development tools. Contrast OSS offers a comprehensive DevSecOps model that solves these challenges. In this Inside AppSec Podcast, Contrast open-source subject-matter experts Joe Coletta and Pauline Logan take a look at some of the key findings in the Open-source Security Report and examine core capabilities in Contrast OSS and the Contrast Application Security Platform. 

Use of open-source frameworks and libraries offers organizations added scale—the ability to achieve the speed and efficiency demanded by the modern software development life cycle (SDLC). Yet, there are various differences in open-source libraries in terms of vulnerabilities and licensing, and open source can expose applications to significant risk if the right application security approach is not taken. Listen to this Inside AppSec Podcast with Contrast Security subject-matter experts Joe Coletta and Pauline Logan to learn about the risks of open-source code and why you must heed the risk signals to avoid exposing applications to malicious attacks. 

2021 is the year of the software supply chain when it comes to cyber risks. Thousands of organizations have been repeatedly hit from multiple points across the software factory attack surface. The January-February 2021 Contrast Labs Bimonthly AppSec Intelligence Report contains trend data reflecting these concerns. In this Inside AppSec podcast, Contrast Security's CISO David Lindner and Sr. Data Analyst and Data Scientist Katharine Watson discuss highlights and key takeaways in the report.  Visit our resource page to download this report and more. https://www.contrastsecurity.com/resources/product-info

Go is an open-source programming language that makes it easy to build simple, reliable, and efficient software across various operating systems. But until now, developers and application security specialists were stuck using legacy application security methods that generated high volumes of false positives and struggled to secure application programming interfaces (APIs)—which are often written in Go. In this Inside AppSec podcast, several members of the Contrast product and engineering teams discuss how the Contrast Application Security Platform now supports Go. Listeners will learn how the industry’s first interactive security analyzer virtually eliminates false positives and dramatically improves the efficiency of both application security and development teams.

The metrics many organizations use today to measure the success of their application security programs fail to capture risks that matter to the business and incentivize the wrong outcomes. A comprehensive approach to DevSecOps that uses metrics that reflect actual risk measures areas such as vulnerabilities remediated, mean time to remediate, and blocked attacks that could have exploited a vulnerability. In this Inside AppSec podcast interview, Contrast Security’s Sr. Director of Product Marketing Mahesh Babu discusses these and other facets of DevSecOps metrics that organizations can use to evaluate their DevSecOps maturity. Listeners will learn what DevSecOps metrics matter—and which ones don’t—and how the Contrast Application Security Platform empowers security teams to build data-driven application security programs that reduce risks and improve efficiency.