Inside AppSec

Contrast Labs publishes research findings based on customer vulnerability and attack data in a bimonthly report. The March-April report pinpoints what percentage of applications contain vulnerabilities and how many vulnerabilities exist on average per application. It also identifies vulnerability attacks that spiked the most over the two-month time frame as well as which vulnerabilities pose the greatest risk based on prevalence and likelihood factors. In this Inside AppSec podcast, Contrast Security’s Data Scientist Katharine Watson and Union University’s Assistant Professor of Computer Science Brian Glas discuss key findings in the report and some of the most relevant takeaways for development, security, and operations teams.

Legacy application security approaches simply cannot scale to the velocity demands of modern software development. As they lack vulnerability context because they run outside of the software, they slow development cycles, impede innovation, and incur substantial inefficiencies and cost. When applications are released into production, this same outside-in approach generates huge numbers of false positives while requiring operations teams to spend significant time calibrating and recalibrating perimeter defenses such as web application firewalls. Instrumentation disrupts this outside-in security approach by embedding security within the software. In this Inside AppSec podcast, Contrast’s CTO and Co-Founder Jeff Williams discusses this paradigm shift and why it offers a much more efficient, effective application security model.

Application performance management anchored its foundation in instrumentation, empowering developers to detect and diagnose application performance problems while writing code to meet the business’s service-level requirements. The same is happening in the area of application security, where instrumentation unlocks automation, dramatically improves accuracy, and speeds vulnerability detection and remediation. New Contrast Security Board Member Joe Sexton spent numerous years of his career in the cybersecurity and application development markets, including serving as the President of Worldwide Field Operations at AppDynamics and Executive VP of Global Sales at McAfee. In this Inside AppSec interview, Joe discusses application security from the perspective of the board and the opportunities security instrumentation offers to security, development, and operations leaders.

The U.S. Department of Energy’s Pacific Northwest National Laboratory reports that one-quarter of software vulnerabilities appear on social media sites—GitHub, Twitter, and Reddit—before they are logged in the National Vulnerability Database. Cybersecurity professionals aren’t the only ones to notice; cyber criminals are busy exploiting this gap. Should professionals tasked with application security be using social media to identify software vulnerabilities? Or is there a better way? In this podcast interview, Contrast Security’s Director of Developer Relations Erik Costlow discusses what challenges this presents to security and development teams and what strategies they can employ to ensure their newly uncovered vulnerabilities are not caught in the crosshairs of cyber criminals.

Developers are embracing Python programming language in growing numbers. It is the most studied language among developers and is used for myriad applications. As a dynamic programming language (as opposed to Java and C that are static languages), variable type is not determined in the application until runtime. For application security to accurately and effectively do its job, Python code must be evaluated in runtime. But this is not possible with legacy AppSec approaches such as static application security testing (SAST) and dynamic application security testing (DAST). A different approach using instrumentation that embeds security within software is needed. In this podcast, three members from Contrast Security discuss how interactive application security testing (IAST) tests applications in runtime is the answer: Trish Reilly, Product Marketing Manager for Contrast Assess, Subhash Arja, Head of Product for Contrast Assess, and Justin Leo, Technical Product Manager for Contrast Assess.

Historically, application security was only in the peripheral purview of the CISO/CSO. But times are changing according to executive cybersecurity recruiter André Tehrani (partner at Recrewmint). In this podcast (part two of a two-part series), André discusses why his firm’s clients are placing application security at the top of the list of skillsets and experience when they engage his firm to identify and recruit new CISOs/CSOs. Firms in the midst of recruiting their next CISO/CSO will learn how to vet candidates for the right application security experience, while CISOs/CSOs looking for their next career opportunity will gain valuable recommendations on how they can use their application security experience to differentiate themselves from other candidates.

This podcast—the first in a two-part series—features an interview with André Tehrani, a partner at Recrewmint, a firm focused singularly on cybersecurity recruiting services at the executive level. André explains how the role of the CISO/CSO has never been so difficult. C-suite executives and boards of directors are seeking CISOs/CSOs with not only the technical cybersecurity skills and experience but also broad business acumen. Soft skills are more than just differentiators for winning candidates today; they are requisites. CISOs/CSOs with this unique combination of technical and business capabilities have a distinct advantage over other candidates who lack their breadth of skill sets and experience. By listening to this podcast, CEOs and boards of directors will discuss what other companies are emphasizing in their CISO/CSO searches, while CISO/CSO candidates will gain critical insights on what skill sets and experience matter the most to prospective employers.

Open-source software (OSS) is critical to software development by accelerating time to market while reducing operating costs. But like any software, OSS introduces layers of risk—both security and IP. Successfully managing OSS is increasingly tied to automating application security processes. Leveraging automation, organizations can track open-source components in use, understand underlying layers of risk, and enable effective mitigation actions. In this Inside AppSec podcast interview, the second podcast in a two-part series, Contrast Security’s Sr. Product Marketing Manager for Contrast OSS Joe Coletta delves into what organizations need to do when securing OSS—involving everything from having the right security policies in place, to establishing continuous visibility, to filtering out noise to focus on the risk that matters most.

We live in a software-driven world where the market demands feature-rich applications delivered at breakneck speeds. Adoption of third-party open-source software (OSS) is a key enabler. More and more open-source frameworks and libraries are being tapped in applications. Use of open-source code by developers grew 40% this past year alone. But as often happens with digital innovation, open source increases security and licensing risks for teams that do not have the right controls in place. In this Inside AppSec podcast interview, the first podcast in a two-part series, Contrast Security’s Sr. Product Marketing Manager for Contrast OSS Joe Coletta speaks about the trends around open source and delineates the types of risks that exist when open source is used in development.