Application security

Ruslan Rakhmetov, Security Vision

Today, most large companies work with various software in one way or another - some develop it themselves, many install it on corporate devices, some work with cloud versions of software. Applications help automate business processes and personnel actions, but they also pose challenges and threats: business users face various software failures and errors, while IS specialists are concerned about possible vulnerabilities in software exploited by attackers. Secure software design, development, implementation, customisation, operation and maintenance is a separate and large area of cybersecurity, and today we will briefly discuss what AppSec (Application security) is and how to ensure application security.

So, if we refer to the recently published standard GOST R 56939-2024 "Information Protection. Development of secure software. General requirements", secure software is software that was developed in the course of implementation of processes and measures to prevent and eliminate software defects. A software flaw is any error made during the development (design, implementation, configuration) of a programme, which may result in the inability to perform the required functionality or be the cause of a vulnerability potentially exploited by attackers to implement information security threats. In accordance with GOST R 56939-2024, the main objectives of secure software development are:

• Identification of flaws, including vulnerabilities, in the software being developed and their prompt elimination;
• Reducing the number of flaws, including vulnerabilities;
• Reducing damage from undiscovered software vulnerabilities.

In a more general definition, AppSec (Application Security) is a set of processes, practices and tools to identify, remediate and protect against vulnerabilities and flaws in applications within the Software Development Life Cycle (SDLC). Security needs to be provided for applications on different platforms (for mobile and desktop operating systems - Windows, Linux, MacOS, Android, iOS, etc.), in cloud infrastructures (Cloud Application Security) and for web applications (Web Application Security). AppSec processes and practices may include:

• Building a Secure Software Development Life Cycle (SSDLC);
• Implement DevSecOps, Security-as-code, Policy-as-code approaches;
• Work with AppSec tools (solutions of SAST, DAST, IAST, SCA, OSA and other classes);
• Conducting Bug Bounty pentests and programmes;
• Conducting training programmes for developers and engineers;
• AppSec incident management (handling vulnerability reports, vulnerability analysis and remediation, development security enhancements).

Implementing AppSec processes, practices and tools will provide the following benefits:

• Improved security: early remediation of software vulnerabilities and flaws reduces the likelihood of cyber threats, data breaches, theft of funds, and business process disruption;
• Reducing the likelihood of cyber incidents: it is preferable to make software secure from the outset rather than deal with a vulnerability-related incident;
• Improving compliance with legislation: ensuring compliance with legislation on the protection of PII, KII, commercial and banking secrets;
• Reduce the impact of software flaws on business continuity: improving application security minimises the number of crashes, downtime and cyber incidents associated with software vulnerabilities;
• Automation: speeding up development processes, reducing the routine load on developers and testers, saving human resources, reducing the influence of the human factor, standardisation;
• Savings: By assessing cyber risks and incorporating IS requirements earlier in the software development process (Shift Left concept), the cost of fixing bugs, flaws, vulnerabilities, avoiding regulatory fines and the need to investigate cyber incidents, saving money on pentests and audits and reducing Bug Bounty payments;
• Increased user satisfaction: increased speed of new versions, improved code quality, increased user loyalty and confidence in the brand, improved vendor reputation;
• Introduction of quality assessment metrics: the digitalisation of development processes enables monitoring and optimisation.

You can use the requirements and recommendations of the following popular standards and frameworks to build AppSec processes:

• Standard GOST R 56939-2024 "Information protection. Development of secure software. General requirements";
• Standard GOST R 58412-2019 "Information protection. Development of secure software. Threats to information security during software development";
• ISO/IEC 27034 series of standards "Information technology - Security techniques - Application security";
• ISO/IEC 24772 series of standards "Programming languages - Avoiding vulnerabilities in programming languages";
• NIST's Secure Software Development Framework (SSDF);
• BSA's Framework for Secure Software;
• Black Duck (formerly Synopsys) framework "Building Security In Maturity Model (BSIMM v15)";
• The OWASP framework "Software Assurance Maturity Model (SAMM);
• OWASP "DevSecOps Maturity Model (DSOMM)" framework;
• Microsoft Security Development Lifecycle (MS SDL) Secure Development Practices;
• Positive Technologies' CyberOrda project and their AppSec Table Top methodology;
• Jet Infosystems' DevSecOps Assessment Framework (DAF).

For example, the BSA's Framework for Secure Software includes the following 3 areas for implementing Application Security processes and practices:

• safe development.

1.1 Secure code writing: threat modelling and risk analysis are performed at the software design stage; software is developed based on secure development standards; software is protected from known vulnerabilities, unsafe functions and libraries; standard software architecture and design controls are applied.

1.2 Testing and validation: the software attack surface is analysed and validated; code reviews are conducted manually or using automation tools; a comprehensive software functionality and security testing plan is implemented; software security features are tested using appropriate techniques; software is subjected to fuzzing tests and pentests.

1.3 Process and documentation: all stages of the secure development process are documented; developers are responsible for software security.

1.4 Supply chain: development processes are linked to supply chain risk management processes; measures are in place to control procurement and verify the transparency and security of third-party software components; supply chain data is adequately protected; measures are in place to protect against the introduction of software bugs and counterfeits; software provenance and data are communicated in a standardised format; and the correctness of software deployment procedures is monitored.

1.5 Development environment: the development environment, including information systems and data, is adequately protected against cyber threats; software is developed using secure development tools.

1.6 Identity and access control management: the software development environment identifies and authenticates all users in the supply chain and software lifecycle; the software development environment enforces policies to control access to data and processes by all users and operators.

• Security capabilities.

2.1 Identity and authentication management support: the software does not contain weaknesses that create prerequisites for authentication failures; the software supports strong identification and authentication methods.

2.2 Patch installability: The software supports receiving and installing security updates and patches.

2.3 Cryptographic services: The software is developed in accordance with an encryption application strategy that defines what data should be encrypted and what encryption mechanisms should be used; weak cryptographic algorithms are not used in the software; encryption keys are protected and verified properly in the software.

2.4 Authorisation and access control: the principle of least privilege is taken into account in software design; the software architecture supports authorisation and access control.

2.5 Logging: all IS events and incidents are logged in the software; the software's logging mechanisms are implemented in a secure manner.

2.6 Error and exception handling: the software implements error and exception handling functionality; in case of failure or unexpected termination of the software operation, predefined fail secure procedures are correctly executed.

• security lifecycle.

3.1 Vulnerability management: the vendor maintains an up-to-date vulnerability management plan; vulnerabilities are identified and addressed quickly and comprehensively with risk-based prioritisation; the vendor maintains a vulnerability disclosure programme.

3.2 Configuration: The software comes with a configuration and a manual for changing settings to ensure safe installation and operation of the software.

3.3 Vulnerability notifications and patching: vendor promptly distributes patches and updates to address identified software security flaws; patches and updates are distributed in a secure manner; patches and security updates are accompanied by notices describing the information required by users.

3.4 End-of-life development and support: the vendor maintains software lifecycle guidelines for users.