Inside AppSec

Traditional perimeter-defense solutions sit outside of applications in production and lack deep insights about applications to more precisely identify potential attacks. The resulting "guessing game" produces high numbers of alerts. Contrast Security's Vikas Phonsa and Blake Connell are experts when it comes to application production runtime protection. In this Inside AppSec podcast, they discuss how perimeter-defense approaches are ineffective in blocking many types of threats and are highly inefficient to deploy and manage—often stretching SecOps teams to breaking points. Contrast Protect supplements traditional perimeter-defense architectures that improve the efficacy of protecting applications while significantly improving the efficiencies of SecOps teams. 

Much attention has been given to the software supply chain over the past several months due to the SolarWinds hack. Open-source libraries are a critical part of the software supply chain, and they can pose serious risk if they are not monitored and managed appropriately. Legacy software composition analysis tools equate third-party vulnerabilities on a level playing field. But the reality is most third-party code is never invoked by the applications in which they reside and pose no risk. A group of experts from Contrast Security discuss findings and insights from the new 2021 State of Open-source Security Report by Contrast Labs in this Inside AppSec Podcast. The discussion touches on library complexities as well as five layers of open-source risk. 

Kenna Security explores detailed data trends for vulnerabilities in the wild, including those found in applications, in its Prioritization to Prediction research series. The company's research includes attack data that is overlaid on top of the vulnerability datasets to determine risk. This Inside AppSec Podcast interview with Kenna Security CTO and Co-founder Ed Bellis explores application security findings and insights from the Prioritization to Prediction Volume 6 report. 

The list of organizations with applications that contain the recently discovered dependency confusion vulnerability continues to grow. Contrast Labs added another one to the list when it identified the vulnerability in an open-source library used by Microsoft Teams. In this Inside AppSec Podcast, Contrast Security's Director of Security Research Matt Austin discusses how he found the vulnerability and what potential risks it posed.

Newly discovered dependency confusion vulnerability found in 35 enterprises—and counting—and threatens software supply chain. Bad actors could inject malicious code without any victim action by redirecting open-source updates to compromised open-source code repos. In this Inside AppSec Podcast, Contrast Security's Director of Security Research discusses why dependency confusion poses a serious threat and how they can detect and remediate the vulnerability before bad actors exploit it.

The latest Bimonthly Application Security Intelligence Report from Contrast Security shows a continued rise in vulnerabilities in .NET applications and a sharp increase in SQL and command injection attacks in late 2020. The percentage of applications with serious vulnerabilities also rose, which should give cause for concern. In this Inside AppSec Podcast, Contrast Security's CISO David Lindner and Sr. Data Analyst and Data Scientist Katharine Watson discuss these and other findings from the November–December 2020 report.

Most risk-scoring models for applications are too simplistic, lacking the breadth of data points needed to provide an accurate risk index. A few open-source projects attempt to build application risk models that are sophisticated enough to account for all of the data and associated nuances needed to pinpoint a risk score that is accurate and meaningful. The problem is that they are too complex to easily implement and manage in an ongoing basis. In response, Contrast Security recently released a RiskScore (Beta V.5) based on an algorithmic risk model that accounts for all of the relevant data points that is also simple to use and manage. This Inside AppSec Podcast interview with Contrast CTO and Co-Founder Jeff Williams, CISO David Lindner, and Sr. Data Analyst and Data Scientist Katharine Watson explores the reasons Contrast developed an algorithmic RiskScore, why and how it plans to release it as an open-source project, how organizations can contribute to it and leverage it, and what the results resemble when it is applied to vulnerability types using Contrast Labs’ application vulnerability and attack data.

With headquarters in Greece and 750-plus employees, Kaizen Gaming delivers casino and sports games that tally more than 200 million annual customer transactions. In this Inside AppSec Podcast, Kaizen Gaming's Technical Security Manager Aggelos Karonis discusses why he and his team turned to application security using instrumentation based on Contrast Security. The podcast interview touches on some of the business outcomes as well as key lessons learned. 

The SolarWinds cyberattack has been dubbed the “hack of the decade” with over 18,000 SolarWinds customers affected. It accentuates the critical importance of software security—from technology to processes. In this Inside AppSec Podcast, Contrast Security’s CTO and Co-Founder Jeff Williams discusses emerging details around the hack and implications for application security.

This Inside AppSec podcast interview with Contrast Security's CTO and Co-Founder Jeff Williams examines key findings in Contrast's 2020 State of DevSecOps Report. With 95% of organizations reporting at least one successful application exploit in the past year, development, operations, and security professionals need to take heed and ensure they have the right security measures in place. In addition to application risk, the interview touches on a number of other topics, including the deleterious outcomes resulting from successful exploitations, the huge amount of time security and development teams spend identifying and remediating vulnerabilities, and how and what organizations should measure and track at the board level.