Preventing broken trust

1. Reduction of the application attack surface

To prevent vulnerabilities, it’s important to have a process for attack surface management, including asset discovery, the decommissioning of redundant assets, and the centralization of functionalities. An effective process requires the involvement of application teams, systems teams, security champions and others who are responsible for the assets.

For example, to reduce the attack surface on a customer-facing application programming interface (API), your enumeration and discovery process might identify API endpoints that application teams are not aware of and could be exposed to attack. From there, you can work with the asset owner to determine which endpoints should be public-facing and which should be decommissioned.

You can also determine which functionalities are redundant and can be consolidated. Fewer APIs and endpoints mean fewer public-facing assets to protect.

2. Proactive security testing

Another key prevention strategy is the integration of security in development pipelines and processes. That should include not only tooling but also training, enabling development teams and systems teams to keep their assets current with enterprise security standards and best practices.

In addition, these teams should actively partner with security to identify sensitive assets that should be tested at a more regular cadence and with a greater level of scrutiny.

For an example of integrated security in a DevOps pipeline, envision a robust e-commerce application. Security should be a part of each stage of the development lifecycle:

• Before the app is in a running state, the code base should receive static application security testing (SAST), with results imported into a centralized vulnerability management system. This centralization can prevent the kinds of issues often identified in asset discovery.
• Once it reaches a running state, the app should receive dynamic application security testing (DAST).
• As it nears a production release, it should receive more comprehensive manual penetration testing, which validates that the business logic is sound and free of glaring weaknesses.
• Finally, once the application is mature, with a regular release cadence, the development pipeline can leverage the integrated DAST, SAST, and vulnerability management systems to block code pushes that have severe vulnerabilities.

3. Collaboration for resilience

With similar methods, progressive security organizations are earning and maintaining stakeholder trust. And as part of their approach, many are enlisting managed services providers with domain experience.

No matter how hard you work to fortify your vase, there will always be bad actors looking to shatter it, and they continue to grow in number and sophistication. The security teams that succeed will form a united front—collaborating with system owners, application owners, business owners and external providers—to defend stakeholder trust.