Inside AppSec

Contrast Security has experienced tremendous growth over the past year, and company culture remains a critical priority. Alignment of unique business practices such as a hybrid workforce, use of OKRs to align individual metrics with companywide metrics, and a customer-centric focus have helped Contrast to scale its business and transform the AppSec marketplace through its DevOps-Native AppSec platform based on instrumentation. In this podcast, Babak Dehnad, the vice president of People at Contrast, discusses why Contrast was named an Inc. magazine Best Workplaces award winner and provides recommendations to other late-stage growth startups on how they can use company values and culture to propel their businesses forward. He argues that COVID-19 work-from-home mandates thrust these issues even further into the limelight, often being the difference between a productive and engaged workforce versus one that is without direction.

There are many options when it comes to the application security (AppSec) market. Many traditional approaches are inefficient, ineffective, and lack the scale demanded by modern DevOps and Agile application development. Code halts, false positives, and even false negatives inflict many organizations, slowing development cycles and drowning DevOps and SecOps teams in vulnerability alerts that pose no risk to the application in question. Contrast Security offers a paradigm shift by embedding security instrumentation within the software, automating vulnerability identification and the remediation verification. It also enables developers to fix vulnerabilities while they are coding and extends instrumentation into production runtime. In this Inside AppSec podcast, Contrast’s Chief Strategy Officer Surag Patel and Director of Customer Marketing and Advocacy Jaweed Metz discuss the AppSec market, including the Gartner “2020 Magic Quadrant for Application Security Testing,” and how Contrast is transforming the space.

Organizations are turning to DevOps and Agile development to address the speed and agility requirements digital transformation demands. As the number of applications increase and their sophistication grows, so are the number of application programming interfaces (APIs) that connect to them. These offer an attractive target to cybercriminals, with experts predicting that APIs will soon become the #1 targeted attack vector in the enterprise. In this podcast, Contrast Security’s Director of Developer Relations Erik Costlow discusses how API vulnerabilities pose serious risks to applications and what development and security professionals can do to protect the APIs used by their applications.

There is widespread concurrence that the web application firewall (WAF) is insufficient when it comes to protecting web applications. In this podcast interview, the first in a two-part series on application runtime security, Contrast Security’s Head of Product Marketing for Contrast Protect Derek Rogerson discusses how a WAF runs on the perimeter and lacks the context needed to identify which attacks pose a risk and which ones do not. This results in piles of false positives that consume valuable time to remediate. Plus, because WAFs employ signatures to identify potential threats, they fail to pinpoint unknown threats and zero-day attacks. Finally, WAFs require regular recalibration to accommodate threat changes, which often is a heavy lift for most security teams.

Solving the risks associated with perimeter defenses that rely on web application firewalls (WAFs) requires a transformational approach to application security (AppSec). In this podcast, the second in a two-part series on application runtime security, Contrast Security’s Head of Product Marketing for Contrast Protect Derek Rogerson and Director of Developer Relations Erik Costlow explain how runtime application self-protection (RASP) addresses the failings of perimeter security by embedding security instrumentation within applications in runtime. Listeners will also learn the critical requirements they need to seek when evaluating different RASP solutions.

Contrast Labs publishes research findings based on customer vulnerability- and attack-related data in a bimonthly report format. A broader and deeper understanding of trends around vulnerabilities and attacks enables security teams and developers to hone their application security defense strategies and tactics for optimal outcomes. The latest report includes details around what vulnerabilities are the most prevalent as well as the most likely to be attacked. Not every application is the same, with a subset containing a large number of vulnerabilities as compared to a majority that have significantly fewer. For this Inside AppSec episode, Jeff Williams, CTO and Co-founder at Contrast Security, and David Lindner, Director of Application Security at Contrast, discuss key findings from the report and provide actionable takeaways for developers and security professionals.

Old-school application security approaches such as static and dynamic testing fail. Dynamic application security testing (DAST) misses many vulnerabilities, leaving organizations at serious risk. Static application security testing (SAST) uses signature-based approaches that pinpoint huge volumes of false positives that incur substantial inefficiencies for both security and development teams. In addition to requiring time-consuming code halts, both SAST and DAST also struggle immensely when it comes to APIs that are connected to individual applications. Security instrumentation changes the paradigm, integrating security sensors into application routes that allow developers to manage vulnerabilities as they are coding within the application itself. In this podcast, Contrast Security’s Chief Strategy Officer Surag Patel explains how doing so speeds development cycles, facilitates collaboration between security and development teams, and improves efficiencies by eliminating false positives and automating time-consuming, manual workflows.

The latest draft update of new requirements from the National Institute of Standards and Technology (NIST) confronts the failures of traditional application security tools that use static and dynamic testing approaches. The new NIST standards include guidance on the adoption of instrumentation in the form of interactive application security testing (IAST) and runtime application self-protection (RASP) tools. These standards are critical for reducing alert noise, minimizing interruptions to the development cycle, and prioritizing vulnerabilities that pose the greatest risk. In this Inside AppSec podcast, Contrast’s CTO and Co-founder Jeff Williams delves into the details of these two new standards and their implications for security and development teams.

Traditional application security approaches use brute line-by-line code scanning that halts operations and development and generates piles of false positives. And they don’t work: Development teams are unable to determine how much of their application attack surface has been assessed for vulnerabilities. An integrated capability within Contrast Assess, Route Intelligence enables developers to know the full extent of their application security posture. It also automates vulnerability identification and remediation verification, saving development and security teams hundreds of hours annually in manual, time-consuming processes. This Inside AppSec Podcast explores Route Intelligence and what it means for developers and security professionals with three subject-matter experts from Contrast Security: David Hafley, director of engineering; Subhash Arja, head of product for Contrast Assess; and Trish Reilly, principal product marketing manager for Contrast Assess and Route Intelligence.