May 2020 Summaries

Front-end developers often use the command-line tool curl for troubleshooting network issues and fixing security vulnerabilities, as it allows for executing requests and identifying problematic code sections. StackHawk enhances this process by providing an application security testing tool that scans for security bugs, such as cross-site scripting and SQL injection, through client-side inputs. The platform's new Validate Finding feature enables developers to quickly address these vulnerabilities by generating specific curl commands that replicate potential attacks, allowing for step-by-step debugging in an integrated development environment (IDE). This integration empowers developers to take control of their application security by understanding and protecting against possible threats, thus ensuring the robustness of their web applications.

Continuous integration and continuous delivery (CI/CD) have transformed software engineering by enabling frequent, automated deployment of small code changes, yet application security has lagged behind, relying on outdated technologies and methods not suited for modern workflows. Traditional application security practices often prioritize identifying issues over resolving them, leading to long lists of vulnerabilities that are deprioritized in favor of new features, leaving developers to address security flaws in code they haven't worked on for extended periods. To address these challenges, a cultural and technological shift is needed, integrating security testing directly into CI/CD pipelines through tools that support developer-first security. These tools should include both Static Analysis Security Testing (SAST) and Dynamic Analysis Security Testing (DAST) to detect vulnerabilities in code and running applications, respectively, and should be chosen based on their compatibility with modern development paradigms and effectiveness in managing noise from false positives. Implementing these tools in a non-blocking manner initially allows teams to triage existing security issues while gradually fostering a culture where developers take ownership of fixing security bugs, supported by enhanced visibility and collaboration facilitated by tools like StackHawk and Snyk.

StackHawk faced challenges in managing dependencies across multiple repositories without using a mono-repo, which resulted in issues of drift among various projects, particularly concerning versions of plugins and dependencies. To address this, they developed a custom plugin and platform approach that allows for consistent management of shared dependencies across projects. This method involves creating a custom plugin to share common configurations and a custom platform for managing dependencies, both of which are published to a Maven repository for easy integration into dependent projects. By implementing this solution, StackHawk has achieved more consistent and manageable build files across their services, aligning dependency versions and reducing the risk of errors due to version mismatches, despite introducing a bit of additional complexity in their build system.

Integrating application security (AppSec) into the developer workflow often leads to friction due to outdated security concepts and tools that are difficult for developers to learn and use effectively. Training developers in AppSec can be challenging, as it involves complex terminology and tools that do not align with developers' primary focus on feature delivery. This situation is exacerbated by security teams' excitement over finding vulnerabilities, which results in a disconnect between security and development teams, often leading to an adversarial relationship. Developers need security tools that integrate seamlessly into their workflow, allowing them to identify and prioritize security vulnerabilities alongside the development process. Companies like StackHawk aim to provide developer-friendly AppSec tools that integrate into the build pipeline, enabling developers to address security issues early in the development cycle. To succeed in AppSec, collaboration between security and development teams is essential, with developers taking ownership of code quality and security being a joint responsibility.