No Second Chances: App Shielding and the Emerging Need for DevSecOps

October 9, 2018 1602 Views Gabriel Torok

App development now happens at breakneck speeds as companies recognize the need for first-to-market applications that exceed consumer expectations for usability and performance. The root of this rapid release cycle? DevOps — the combination of development and operations teams to deliver best-in-class applications ASAP.

But more apps on the market more quickly means more chances for security issues — as noted by Bank Info Security, 60 percent of all breaches over the last two years started with known software vulnerabilities. Bottom line? DevOps is getting apps out of development, but lack of security is putting them in harm’s way. There are no second chances when it comes to first impressions; users won’t come back if applications expose personal data or become malware distribution drones.

The solution? DevSecOps: Security as a fundamental aspect of application development. Here’s what you need to know.

End of a Post-Security Era

DevOps’ biggest advantage? Speed. Its biggest drawback? Security. Consider: Recent data pegs the number of Android apps released worldwide each day at just over 6000. The result? It’s the end of the post-security era: App security can’t occur after development because there’s no lull, no opportunity for IT teams to thoroughly assess the risk of new code and make necessary changes — organizations in a mobile-first world need to push one app out the door and make room for the next.

DevSecOps emerged as a response to this shift; given the incredibly short window of time new apps must make a good impression on users and stakeholders alike, security-by-design is now imperative in app evolution. Put simply? You don’t get a second chance at a first impression.

What is DevSecOps?

While DevOps has been part of IT culture for the better part of a decade, DevSecOps is relatively new. Still, it’s gaining ground — 96 percent of organizations surveyed say producing secure code is “desirable” or “highly desirable.”

Put simply, DevSecOps is the combination of development, security and operations in the app development lifecycle. Instead of security being “tacked on” just before applications go live, DevSecOps puts it front and center with development and operations. Ideally, the addition of security to the initial stages of application design helps identify and eliminate code flaws or vulnerabilities that might otherwise be discovered by malicious actors before being fixed. While this means more time investment at the beginning of the development cycle, it reduces the risk of zero-day or open-source vulnerabilities that could force the creation of immediate hotfixes or the removal and redesign of applications from the ground up.

Culture Shift

As noted above, the vast majority of organizations want to adopt a DevSecOps model, but just eight percent have developed best practices that enable this digital transformation. What’s the disconnect? It starts with culture. Developers and security teams may not see eye-to-eye on certain aspects of app development, and continually-evolving stakeholder expectations can make it difficult to effectively implement DevSecOps.

Start with the understanding that there’s no “finish line” here — all apps could be more secure, and no app is ever perfect. DevSecOps reduces the total number of vulnerabilities in addition to time spent identifying and eliminating these vulnerabilities after applications go live. Next, ensure that communication is front-and-center: If devs, infosec and operations pros can’t speak freely about the projects they’re working on and what they need to be successful, DevSecOps will stall out in the first few months.

Also critical? Security processes adapted to existing developer processes wherever possible. While there’s a need for developers to compromise as well, infosec leaning into the Dev side of the equation can help reduce friction and improve time-to-market. Last but not least? Implement strong monitoring controls. Just like any new initiative, metrics are key to success: You need to know where processes are working, where they need improvement and where they’ve come off the rails.

Effective Implementation

You’ve shifted focus and created a DevSecOps team. You’re prepared for the culture shift. So what does DevSecOps look like in practice?

From a basic security perspective, it’s continuous testing for zero-day, open source and known code vulnerabilities (both statically and dynamically) with each iteration of your application. Instead of attempting to round up and mitigate multiple security issues just before deployment, adopting DevSecOps provides the ability to iterate security in tandem with app function and performance evolution.

If your application will eventually run in a low trust or untrusted environment such as on a mobile device, application shielding can be incorporated into your DevSecOps process to harden apps against unwanted inspection, tampering, or reverse-engineering. If your application has unique intellectual property (IP) or accesses sensitive information, you may be at risk of being targeted by hackers — regardless of your basic security profile. By incorporating app shielding into your DevSecOps pipeline, it’s possible to harden and protect high value application that run in untrusted environments.

DevSecOps: Second Position, First Priority

Security is a late addition to DevSecOps but don’t let its position in the term fool you — security-by-design is the first priority of any DevSecOps deployment. By the linking creative, functional and defensive aspects of your app development to create a continuously-iterating and reinforcing process it’s possible to embrace the speed of app deployment without sacrificing security.

Latest Blog Posts

Non-Traditional Attack Vectors: Three Questions Every CISO Needs to Ask

Malicious actors — like any thieves — live by a simple rule: If the front door is locked, break the window.

It’s why threats like fileless malware and crypto-jacking have seen substantial gains over last few years. It’s why — despite increasing employee education and IT training — hackers are still hooking phish by developing more sophisticated and authentic-looking email spoofs. Cybercriminal communities, meanwhile, continue to grow on the dark web, allowing attackers to share info, purchase exploit kits and identify potential targets.

What does this mean for CISOs? That typical defense efforts are being outpaced as familiar attack vectors are replaced with non-traditional threats. But it’s not all bad news; here are three questions every CISO needs to ask to help close the doors, bolt the windows and leave hackers out in the cold.

Gabriel, you have been in the security industry for over 2 decades. You have seen many different tools and services. Why create a company around something as specific as obfuscation and in-app protection?

Our customers build a lot of really innovative apps that enable their users and customers to do new and cool things. These apps frequently run on untrusted client computers/devices and they control access to customer’s sensitive data or critical devices.

And after all the effort of designing, building, debugging, and deploying their applications, the last thing they want is for an attacker to steal their work or use it to look for vulnerabilities to break into their system.

Long ago, we built a Java code optimizer, but it became clear to us that our customer cared more about the obfuscation effects of the optimization than the actual performance improvement. That is when we really began to focus on app protection. First with Java, then .NET, Android, iOS, Xamarin, JavaScript, etc.

Gartner calls In-App Protection “crucial” in their July 2019 Market Guide for In-App Protection In-App Protection. The guide’s summary advises security and risk management leaders to “take due care in protecting their application clients” in order to avoid “security failure.”

This raises the question – what constitutes “due care?” Obviously, no development organization looks to recklessly expose their applications or sensitive data to attack or compromise. On the other hand, over-engineered (or poorly engineered) security controls can quickly lead to excessive development costs, performance and quality issues, and, ultimately, unacceptable user experiences. While terms and terminology may vary, there is broad consensus on how to best define “due care” for any given application/user scenario.

If you don’t follow application security closely, you might think of application obfuscation and symbol renaming as being synonymous – and with good reason. Many platforms and languages, like .NET, Java, and JavaScript have popular obfuscators that do little else--our own Dotfuscator Community Edition for .NET and ProGuard for Java are good examples. However, obfuscation is far more than symbol renaming – and in-app protection is far more than obfuscation. Much of this expansion has been driven by new security requirements, shifting attack vectors, the rise of mobile and IoT computing and, lastly, the growing recognition inside regulations and legislation of the exposure that can result from inadequately protected software.

PreEmptive has partnered with Microsoft for 16 years and we’ve been involved with .NET since before version 1.0 shipped. From that perspective, it’s hard for us to pinpoint a time where the energy and enthusiasm in the .NET community has been higher than it is now. Over the past few years, Microsoft has put together the annual .NET Conf, completely online with viewers, participants, and local events all over the world. The event is virtual and streamed live over three days.

The big news at this year's .NET Conf was the launch of .NET Core 3, the next step in the continued evolution of .NET. .NET Core 3 is a huge effort, with many moving parts, and Microsoft announced many related releases to support it. Highlights for us included:

No Second Chances: App Shielding and the Emerging Need for DevSecOps

End of a Post-Security Era

What is DevSecOps?

Culture Shift

Effective Implementation

DevSecOps: Second Position, First Priority

Non-Traditional Attack Vectors: Three Questions Every CISO Needs to Ask

Q&A With PreEmptive CEO Gabriel Torok

Gabriel, you have been in the security industry for over 2 decades. You have seen many different tools and services. Why create a company around something as specific as obfuscation and in-app protection?

The Secret to Effective In-App Protection

Symbol Renaming: App Security’s Maginot Line?

Highlights from .NET Conf 2019

Latest Blog Posts

Non-Traditional Attack Vectors: Three Questions Every CISO Needs to Ask

Q&A With PreEmptive CEO Gabriel Torok

The Secret to Effective In-App Protection

Symbol Renaming: App Security’s Maginot Line?

Highlights from .NET Conf 2019

Twitter