How To Do AppSec: The Application Security Guide

Modern applications are sophisticated, with different third-party software and hardware components and complicated integrations compared to legacy applications. With these complications, there is an increase in exploitable vulnerabilities in the application layer. Thus, application security is one of the most critical aspects organizations should focus on to secure their applications from cyberattacks. 

This article explains the concept of application security, its significance, the most common application security vulnerabilities and — best of all — actionable techniques and best practices to support AppSec.

---

---

Defining application security

Often known as AppSec, application security is the practice of applying best practices, processes and tools at the application layer to mitigate threats from exploitable vulnerabilities. Instead of waiting until you deploy applications to production, AppSec focuses on building secure mobile, web and cloud applications throughout their development lifecycle, from start to finish.

AppSec is a proactive approach to security that help prevents threats at the initial stages rather than a reactive approach. 

Adequate security procedures must apply from the initial stage of the application development and continue while the application is in production like automated security scanning. AppSec is (and should be) a continuous process that aims to be as defensive as possible against ever-changing cyber threats.

(Stay on top of evolving threats with cyber threat intelligence.)

Significance of AppSec

Cyber threats continue to evolve. Emerging techniques can breach the most secure software applications. (As secure as anything can get, that is.) Even a small vulnerability, like a configuration issue, can lead to a huge data breach if not identified at the beginning of the development.

Now, add in the fact that the majority of applications are cloud native. According to Snyk’s 2021 State of Cloud Native Application Security report, more than half of the participating organizations have experienced misconfiguration or known vulnerability incidents in cloud-native environments.

Organizations must incorporate security not only at the network level and at the application level in all stages of the development process. It helps to reveal vulnerabilities from the beginning and apply the necessary security control before it could become a series threat to the organization. 

Prominent application security risks to understand

There are plenty of ways to identify risks. The Open Web Application Security Project (OWASP)  describes web application software's top vulnerabilities. The Common Weakness Enumeration (CWE) lists the top 25 most dangerous software weaknesses, which helps developers identify what vulnerabilities they should focus on.

According to the CWE, the following are the most critical application security risks you can find in software today.

• Out-of-bounds write. Writing to a memory that exceeds the buffer boundary. For example, writing to an array past its highest index. This can introduce application crashes, data corruption and malicious code execution.
• Cross-site scripting (XSS). Attackers exploit a web application to inject malicious scripts into a safe website through a client-side script. 
• SQL injection. An attack that exploits weaknesses in SQL queries and gains access to application databases. These attacks could allow attackers to execute DB operations in the database, resulting in sensitive data breaches. 
• Improper input validation. A vulnerability that occurs with inputs not properly validated. This vulnerability allows attackers to enter potentially dangerous inputs.
• Out-of-bounds read. Applications allow reading before and after the buffer's boundary, causing the application to crash or allowing attackers to read sensitive data in memory. 
• OS command injection. Weakness in the web application that enables attackers to execute commands in the operating system. This attack can exploit your data and other hosting infrastructure. 
• Use after free (UAF). This happens when the program fails to clear the pointer to the memory location after freeing the space. This dynamic-memory-related vulnerability lets attackers use these dangling pointers to execute arbitrary code. 
• Path traversal attack. This allows attackers to access files and directories outside the root folder. It can expose critical files like application source code and configuration files.
• Cross-site request forgery (CSRF). Tricking users into doing unauthorized actions on a website they have access to and are authenticated. For example, tricking users into changing the password, email address, fund transfer, etc. For this, attackers can use social engineering techniques.
• Unrestricted upload of file with dangerous type. This application allows users to upload files with dangerous file types. This vulnerability lets attackers upload or transfer malicious executable files.

Ongoing challenges to AppSec

Beyond these specific techniques, several security challenges or lack of appropriate practices also contribute to security risks. These are common security challenges associated with modern applications.

• Open-source and third-party software vulnerabilities
• Not shifting left with your security approach
• Lack of security awareness and training 
• Improper access controls
• No risks assessments 

Application security techniques

There are many ways you can secure your applications from common vulnerabilities like the ones I described above. Common AppSec techniques include access control, authorization, validation checks, security testing and data encryption. Let’s take a look!

Authentication and authorization

Control access by implementing proper authentication mechanisms restricting access to applications. Today, password-based access control is no longer enough — attackers can easily evade weak passwords. Use multi-factor authentication to provide an additional layer of security.

Authentication should follow authorization to grant access only to required resources for authenticated users.

Proper input validation checks

Validate user input against every acceptable criterion. This method includes allowing inputs from specific formats and lengths, checking for executables, etc. 

Encryption

Encrypt data that flows between the application and the end user. This way, cybercriminals cannot view traffic contents with sensitive data. This also involves encrypting application configurations like

• Database credentials
• API shared secrets
• System-to-system user credentials
• Etc. 

(Check out our guides to end-to-end encryption & data encryption.)

Access logs

Maintaining access logs for the application enables organizations to track who accesses the app. This way, it’s easy to identify which IP address occurred in a data breach. 

(Learn more about auditing logs.)

Application security testing tools

Different security testing tools allow developers to analyze the code during development and production.  These are security testing tools you should incorporate into your application. 

• Static Application Security Testing (SAST). Static security testing tools allow developers to quickly identify security vulnerabilities in the code and fix them during development. 
• Dynamic Application Security Testing (DAST). These tools can analyze security vulnerabilities in real-time in production environments. DAST tools also enable developers to simulate cyberattacks and reveal detecting runtime errors. 
• Interactive Application Security Testing (IAST). This SAST and DAST hybrid provides more accurate security testing results. In this approach, you can analyze the code during any stage of development and in real-time in the production application.
• Run-time Application Security Protection (RASP). These tools allow organizations to run continuous security testing and automate the incident response during security breaches. For example, alerting the security teams, terminating the application to avoid spreading the threat, etc.

Code obfuscation techniques

Code obfuscation tools hide the application code so that attackers cannot know the internal functionalities of the application. This technique prevents code tempering and reverses engineering attacks. 

---

---

AppSec best practices 

So far, this article has focused on specific risks and techniques to remedy them. Of course, you can also take a macro approach that helps you make all of your development and areas of focus more secure. Here are common overarching best practices to enable cyber hygiene and resilience across the enterprise.

Use threat modeling

Threat modeling is the process of identifying threats that can damage:

• The software application itself
• Relevant defense mechanisms
• Your validation of the security mechanisms against threats

Threat modeling is typically carried out in the design phase of the development process. It helps organizations deeply understand the software architecture, threat agents, potential system damage and security requirements. Threat modeling generally formulates the following artifacts:

• Application diagram
• Attacker profiles and their attacking techniques
• Remediation methods
• Remediation validations techniques

(Curious about threat hunting? See how to use Splunk to hunt threats.)

Address vulnerabilities in open-source & third-party software

Open-source software tools, libraries and modules bring a lot of advantages to software development. However, they can expose your application to a lot of security vulnerabilities. Hence, it is important to keep track of updates from such software and apply security patches as soon as they are released to avoid exposure to cyber threats.

Use security monitoring tools to monitor apps continuously. That software needs to be kept updated to its latest version. 

Practice shift-left security

Traditional development (like that in waterfall and certain DevOps environments) considers security only after the development process ends. This scenario often has a few phases:

1. Dedicated security teams assess the security of the end product.
2. Development teams must wait for the results of the security assessments.
3. Dev teams likely have certain work to do to improve and increase security.
4. Product deployment is blocked until you appropriately address critical security issues. 

The shift-left approach takes a completely different and more efficient approach. It incorporates application security strategies in every development life cycle as well as in every environment from development to production. The result? No delay between addressing security issues and deploying a secure application to production. 

Provide necessary security training for developers

New developers may lack understanding and awareness about security best practices in coding. It is important to make every developer know what to avoid in coding that could become a security vulnerability. 

Assess developer knowledge to understand the knowledge gap, then provide the necessary security training. Some organizations today have specific mandatory security training courses for every developer to educate on safe coding practices. 

You can also empower your dev teams with expert-recommended security articles and books, in-person and online security events and the latest research from teams like Splunk’s own research teams, like the Splunk Threat Research Team and SURGe (with frequent live chats about cybersecurity news.)

Integrate security scanning for pipelines

Follow an integrated security approach that triggers security scanning at every code commit or deployment. This makes addressing security vulnerabilities faster. Organizations also must ensure they hire security experts that can realize these CI/CD practices.

Do not ignore app security

Applications are critical parts of your organization’s overall security strategy. Building more secure code minimizes common security vulnerabilities, as discussed in this article. Implementing authentication and authorization techniques, input validation, encryption, logging, and using security testing tools are common AppSec security techniques.

Finally, follow security best practices like threat modeling, using security scanning tools, adopting a shift-left security approach, providing security training, and addressing vulnerabilities in software. 

What is Splunk?

This posting does not necessarily represent Splunk's position, strategies or opinion.

---