Derek Fisher

Don't boil the ocean and know what your goals are. Are you trying to actually find issues? Are you trying to meet compliance or customer demands? Do you have the staff to resolve issues that are found. You need to be able to address these questions before embarking on the AST journey. Without understanding whether your organization is capable of taking on an AST tool, you will likely soon find your team buried in results with diminishing trust in the AST and reduced ROI.

Ideally, the organization can leverage free scanners that integrate into the IDE so that developers can get early feedback and correct issues before checking in the code. Once the code is checked in, COTS should be used to scan broader parts of the code, and higher risk code. Adjust these tools based on ongoing feedback to optimize their effectiveness. However, often times the free tools are capable of providing comparable results to COTS for basic scanning. For the more comprehensive scans on higher risk code, the COTS should be used. This employees a combination of rapid, free scanners for frequent checks and more comprehensive scanners for high risk code. Providing the balance of reduced costs, while providing wider coverage.

Application security testing (AST) tools are used for detecting threats in applications but often struggle with accuracy, particularly in regards to false positives. These inaccuracies not only burden security teams, consuming about 25% of their time according to the Ponemon, but also cause alert fatigue. Tools like SAST often generate high numbers of false positives by analyzing source code without execution context, while DAST might miss issues due to limited internal code visibility. Tool sprawl can lead to inefficiencies in development, operations, and IR by further inundating organizations with noise. Focusing on a small but well tuned set of scanning tools can reduce the noise and get more actionable output from the ASTs.

Scope matters when reducing scan times. Take SAST for example. Optimizing SAST to reduce scan times can be accomplished by performing incremental scanning by targeting only newly modified or added code segments, and narrowing the scope to code that is more susceptible to risks. Leveraging parallel processing capabilities of SAST tools can increase scan times by analyzing different parts simultaneously. Lastly, integrating SAST tools into the development environment for real-time scanning and immediate feedback, prioritizing high-risk areas, and excluding stable precompiled binaries from scans further streamline the process. These methods collectively reduce the need for extensive scans while accelerating the development cycle.

AppSec tools help detect vulnerabilities early and cost-effectively. SAST scans source code for potential flaws, while DAST tests running applications for runtime vulnerabilities. IAST combines these approaches, providing detailed insights into both codebase and execution. SCA checks third-party components for known vulnerabilities (critical today with complex supply chains) Inclusion of fuzz testing, which introduces random inputs to discover unexpected behaviors, and Infrastructure as Code (IaC) tools, which scan infrastructure scripts for vulnerabilities and drift, further strengthen security in the SDLC. Integrating these tools ensures robust, secure software development, reducing risks and aligning with proactive security practices.

Implementing a security maturity model within an organization involves customizing the model to align with specific business needs and conducting a thorough assessment to identify current security capabilities and gaps. Choose a model like SAMM or BSIMM, and engage stakeholders across all levels to define clear, measurable goals for desired security maturity. Develop a detailed plan that includes prioritization, resources, and a timeline for achieving targeted maturity levels. The most important aspect is to ensure that you have buy-in from leadership and a willingness from the organization to pursue the model. Regularly monitor and update the security practices, adjusting the approach as new threats emerge and technologies evolve.