Veracode's Craig de Lucchi expands on common obstacles in AppSec programmes, power of collective learning

Craig de Lucchi, Veracode Account Director.

---

Is software part of how you are delivering value to your customers? But how is your organisation innovating through software?

Software adds value, but it also introduces risk. Let’s take the example of Equifax, described as a data ‘mega-breach’ that exposed the personal information of 147 million people and was caused by an application vulnerability that cost the company more than $2 billion, with about $700 million in settlements alone. The company went on to become the subject of congressional hearings as well as several investigations.

The interesting thing about this is that it had application security tools in place, so what went wrong?

Veracode has partnered with companies to deliver application security programmes since 2006 and here are the most common reasons we see why secure software initiatives fail:

Firstly, AppSec programmes fail when developers are not engaged or empowered to fix vulnerabilities and security teams are only incentivised to find weaknesses but not to remediate them.

Too often, security teams dictate rather than partner with development teams and have unrealistic expectations. The mountain of technical debt can be enormous, and developers are often not trained to fix potential liabilities. The net result is a toxic relationship between security and development.

Secondly, tooling is difficult to manage, and many solutions require weeks if not months of deployment before they are able to conduct the first scan. Then come the operational headaches, plus scalability and high availability issues. Maintaining solutions can be challenging, leaving businesses months behind coverage for the language and framework versions their development teams are using.

Thirdly, security teams are often busy running scans and keeping infrastructure up to date that they simply don’t have time to focus on the programme itself. They’re in a vicious cycle and don’t have the headcount to deliver a holistic AppSec Programme that gets stakeholders aligned on the vision and roadmap for it. Reporting the correct metrics to C-Level executives on successes is difficult and hence programmes continue to be underfunded.

Veracode’s approach to application security addresses these three areas:

Veracode provides a unified solution for all major application analysis types, languages and frameworks. This helps companies to consolidate point solutions that would otherwise have to be managed separately, which can lead to complex deployments, operations and reporting. Veracode solutions integrate with the development pipeline so that analysis can be fully automated.

We help businesses to scale their security teams by engaging and empowering security champions within companies’ development teams. We guide teams towards targeted training; if one team has a higher frequency of the same security issue, we focus our programmes on fixing vulnerabilities, not just finding them, so organisations don’t end up in the same position as Equifax.

Finally, we assist security teams with AppSec governance. This starts by helping businesses to define a programme to achieve compliance with internal policies, contractual requirements, regulatory mandates. We help companies to scale programmes through best practices that we have developed over 15 years while working with over 2 500 customers. Furthermore, we can assist with selling the value of AppSec programmes to senior management, development teams, and even customers.

Most AppSec programmes forget there is only one role that can fix security finding and that`s the developer. Yet, many of them don’t empower developers to do so and focus their programmes on finding flaws and not fixing them.

Veracode offers developers three types of advice that delivers a high percentage of fixes. Firstly, they receive automated advice from our solution in the form of text or video tutorials. Secondly, they can reach out to peers in the Veracode Community and see if they can find a solution there. Thirdly, they can schedule a call with a secure coding expert to go through the source code together and discuss approaches to fixing the issue. The Veracode approach makes this much easier because our consultants can view the data and control flow of the application to suggest the best way to fix issues. 

We help you to reduce the introduction of new flaws through e-learning and direct feedback through an integrated development environment (IDE) scan which aims to engage developers at a higher level, augmented by lab courses that are provided that guide them through screening with a view to fixing real applications.

Technology alone cannot solve your AppSec challenges, you need to keep people and processes in mind as well and Veracode can help you execute your AppSec governance programmes.