The modern world runs on web applications, and governments are no exception. But at every level, these apps are growing at a rate that is overwhelming agencies’ security teams. To ensure security of these web apps, it is vital that new processes be introduced to help maintain a strong IT security risk posture.
Traditionally, agencies have used manual penetration testing to identify web app security vulnerabilities or scanners prone to false positives that then require manual verification before acting. Not only is this process costly and slow, but it raises the potential for human error exponentially.
Fortunately, the right mix of strategies and tools can keep agencies safe from resilience-damaging security incidents. By automating processes in DevSecOps and leveraging Dynamic Application Security Testing (DAST), agencies can plug every gap in their web apps.
“Fifteen years ago, there were 50 million websites in the IT marketplace,” said Ted Rutsch, Federal Account Executive at Invicti Security, a web application security solutions provider. “Now there are nearly 2 billion. Application security automation has become paramount.”
Rutsch provided three tips to agencies looking to secure their web apps for stronger resilience.
1. Dive into DevSecOps
DevSecOps combines software development, security and IT operations into one methodology. Shortening the development life cycle helps agencies continuously provide higher-quality software; making security integral to the development process, meanwhile, assists agencies with avoiding harmful security incidents.
“The life cycle to put out a secure website was eight to nine months,” Rutsch said of the time before DevSecOps. “Today, agencies are doing that in a matter of weeks.”
Furthermore, although DevSecOps begins with people, combining modern security processes with automation can streamline an agency’s path to a strong risk posture.
2. Adopt automation
By introducing security automation into web apps’ software development life cycle. Agencies can intelligently navigate their apps and find exploitable vulnerabilities – without false positives. Integrations directly into the development environment allow for the automation of workflow assignments and can fix retesting to make issue remediation as efficient as possible. Agencies without automation are trying to patch vulnerabilities reactively, Rutsch said.
Additionally, automation can rapidly align agencies with their federal, state, local and global security compliance requirements. Directives like The National Institute of Standards and Technology (NIST) 800.53 and the Federal Risk and Authorization Management Program (FedRAMP), which authorizes cloud services to hold federal data, can now be met, enabling agencies to securely move apps to the cloud.
3. Dynamically test app security
Modern DAST tools identify potential security flaws in web apps by communicating with the front end of these programs. Rather than reviewing static source code, DAST tools detect security gaps by simulating attacks and automatically confirming exploitable vulnerabilities. Ultimately, DAST tools like those Invicti Security provides reduce the time and energy agencies spend to deliver secure web apps.
“You can imagine how overwhelmed some of these application testing teams are keeping up with the release of new and updated apps,” Rutsch said.
By combining automation and DAST processes, agencies can now improve their DevSecOps for better resilience, compliance and stronger web apps.
This article is an excerpt from GovLoop’s recent guide, “Bouncing Back: How Your Agency Can Handle Disruption and Embrace Resilience.” Download the full guide here.
