Consolidating effort for enhanced application security

Software vulnerability report shows that critical vulnerabilities persist

The recently published “2023 Software Vulnerability Snapshot” report from Black Duck uses anonymized data from three years of tests on commercial software systems and applications to demonstrate that while there has been a significant decrease in vulnerabilities—from 97% in 2020 to 83% in 2022—persistent vulnerabilities remain and pose significant challenges to web and software application security.

The report emphasized the importance of a multilayered security strategy that includes SAST to identify coding flaws, dynamic application security testing (DAST) to examine running applications, SCA to identify vulnerabilities introduced by third-party components, and penetration testing to identify issues that internal testing may have missed. With more attackers employing automated exploitation tools capable of attacking thousands of systems in seconds, addressing high- and critical-risk vulnerabilities is vital, not least because well over half of disclosed vulnerabilities are exploited within a week of disclosure.

Major risks that organizations need to look out for include

• Information leakage: Exposing sensitive data to unauthorized parties remained the top security risk from 2020 to 2022. An average 19% of the total vulnerabilities found over all three years of testing were directly related to information leakage issues.
• Cross-site scripting is rising: Of all high-risk vulnerabilities found in the 2022 tests, 19% were associated with cross-site scripting attacks.
• Third-party software increases risk: Of the top 10 security problems in 2022, 25% of tests revealed weak third-party libraries. If you don’t know whether third-party and open source components are used, your software is insecure.

The report found that using multiple testing types is necessary for effectiveness, but businesses struggle to do so without compromising development or triage and remediation. In times of tight finances, consolidation can enhance resource efficiency and improve risk posture.

Consolidate effort to manage multilayered security

While the “Software Vulnerability Report” lays out the importance of a multilayered approach to AppSec, the question of where to start remains. Your teams have likely become accustomed to the tools and processes they have in place, and with risk data scattered among so many point tools and teams, it’s difficult to reign it all in and unwind what’s already in motion.

That’s why starting your consolidation initiative by inserting a layer of abstraction between your development teams and your security tools is a good first step. By inserting this layer, you can achieve three core goals for your AppSec program.

• Your development teams don’t need to learn multiple UIs—they can continue working with the tools they already know.
• Your AppSec team can implement standard and consistent policies across the multitude of point tools being used by development teams across the company, consolidating it down to just one.
• All your security tools are running through a single abstracted tool, providing you with a consolidated windowpane into what was tested, what was found, what was fixed, and what your overall risk is at any point in time.

Application security posture management (ASPM) tools provide this layer of abstraction. They act as a translation layer between AppSec and development, allowing AppSec teams to control and implement policies, SLAs, dashboards, and reporting, while communicating to development what needs to be fixed and how to fix it within the tools they are already using.

An ASPM tool will aggregate, normalize, and prioritize findings across the security tools you already use, all in one centralized location. This will reduce noise for development teams so they can focus on what to fix, in what order, and by what date, enabling them to keep the development process moving. Identifying and prioritizing critical issues with an accurate business context of applications, components, and associated security data provides teams with an actionable picture of overall software risk at any point in time.

This consolidation of effort, for both your AppSec and development teams, will streamline your ability to produce secure code at the velocity your business demands. It also sets you up to consolidate or swap out the point tools themselves because you no longer have policies, processes, or findings weaved into each one.