Traditional methods of security slow down DevOps velocity, and large AppSec testing tools can congest the build, test, and release pipelines. More security tools means more testing, which means more findings that must be correlated, deduplicated, and prioritized to ensure that developers aren’t overwhelmed with data and unable to focus on the security issues that matter most.
A true AppSec culture is one in which people, processes, and technologies are aligned to minimize risk and transform the business. It is a culture shared by the whole organization, not just in the IT or development teams. A comprehensive AppSec culture includes security champions, metrics, planning, a DevSecOps maturity framework, integrated DevSecOps, and training.
Security champions are security-minded employees on the IT or development team, or those who have expertise in security and want take ownership of the application security process by helping enforce that process throughout the SDLC. Champions also educate development teams on security best practices and keep informed of current vulnerabilities and threats for software your organization uses, and internally track vulnerabilities and issues across teams.
If you don’t know where you’re at right now, you won’t know what you need to develop or invest in for the future. A key step is developing a measuring stick to understand how existing processes are working and where they can benefit from improvement or additional resources or budget.
It’s important to build an actionable security plan based on your organization’s policies. A security plan is a living document—It will evolve and mature as you use it, as you discover more about the people, processes, and technologies involved, and as you discover deficits. Any plan is good as long as it works, and then you can create a new one.
To create, or update, a security plan, an organization must
- Build consensus for objectives
- Determine current state of secure SDLC
- Identify target state
- Define the budget and path forward
Key to a robust, holistic AppSec program is establishing a DevSecOps maturity framework. That means defining governance and processes, creating a secure design and architecture, and having all processes function within this framework. Then you can identify what tools are deployed in every step of DevSecOps and compare it to the plan.
Integrate AppSec naturally in the organization and at every phase of software development.
Training employees so they know how to handle DevSecOps tools is vital. Using a tool incorrectly is as bad as not having a tool at all.