Stopping a cybersecurity disaster at the software development level

In recent years, cybersecurity professionals have been waging a war in which victories are elusive and fleeting. At the same time, the explosive growth in the number of connected devices -- from mobiles to the internet of things -- has driven the demand for faster software development, which increases the risk of having unknown vulnerabilities creep into the code that bad guys can exploit. So far, attempts at security have been based on securing the network, encrypting data or securing the device. However, these approaches to security still leave the software at the very core of the system vulnerable.

With every passing year, we see more evidence that current security approaches do not work. Companies and individuals are simply unable to protect themselves from increasingly complex threats by layering on a hodge-podge of security tools. Infrastructure and perimeter-based approaches to security -- the approaches on which we have relied for so long -- are no longer sufficient in a cloud-based and application-centric world.  As a matter of fact, these traditional approaches deliver too many false alarms and fail to identify the causes of major, high-profile breaches.

Criminals and hackers have been profiting from our security failures for years by stealing data that is easily sold to ransomware attackers, state-sponsored groups or gangs of well-organized criminals -- all of which rake in tens of millions of dollars every year. If we want to stop them, we must seriously rethink our approach to security and come at it from a completely different direction. We must focus on “baking in” security during the initial software development phase.

Over the last decade, the industry has experienced a seismic shift. Companies and individuals have moved from purchasing their own infrastructure and shrink-wrapped software to an increasing reliance on infrastructure-as-a-service and cloud-based applications. The world has also gone mobile, choosing tablets and smartphones that enable work to be performed from any location at any time over the historical, traditional office environment.

With this changing landscape, cyber threats have increased in frequency, complexity and impact. Hackers have evolved from the geeky kids showing off their programming prowess to today's reality of rogue nations, cyberespionage and cyberwarfare. When you add in the billions of IoT-connected devices that are being deployed around the world, it is easy to see that we are giving cybercriminals even more potential attack vectors.

The Global CRASH Report from CAST, a software analysis and measurement firm, found that "a significant amount" of unsecured code is currently in use and that the overall quality of "too many" mission-critical functions is "poor." This was a result of analyzing 1.03 billion lines of code contained in 1,850 apps submitted by more than 325 organizations from eight countries.

Security weaknesses begin in the code. For confirmation, consider the Equifax breach that exposed the personal information of more than 145 million Americans, or the havoc caused by the WannaCry attacks. Richard F. Smith, the former CEO of Equifax, has repeatedly stated that the breach was the result of an individual in the company's tech department who failed to ensure that software fixes were implemented. The WannaCry ransomware attacks exploited a known vulnerability in Windows for which Microsoft had released patches at least two months prior to the first attack but that many users had not installed.

The move to agile development is forcing DevOps to become more adept at injecting security into the code they write. At the same time, the move from the waterfall methodology to agile development -- and the demand for innovation that pushes the limits of what is technically possible -- have shortened the acceptable code delivery timeline. In this rush to market, security often becomes more of a nice-to-have than a must-have.

To keep up with the needs of agile development, security must move at the speed of development. New tools and processes are needed to provide developers with the information required to fix the code from the start. Furthermore, developers must be able to look at security from the software's perspective -- from the inside out -- rather than reacting to threats from the outside in.

Developers must have the ability to protect the software at runtime using tools that understand the software’s security-specific requirements by analyzing its weaknesses rather than being focused on threats. They need a frictionless approach for inserting code analysis into the software development lifecycle that provides continuous visibility and protection when pushing out new code or updates. This approach must also provide visibility into how software interacts with the outside world, including inputs and outputs as well as the application programming interfaces and open source software libraries that it uses.

Developers need tools that enable them to look deeper into what software does -- how all of the sensitive data flows through individual workloads as well as through multiple microservices -- to identify weaknesses and vulnerabilities. Having such tools allows for continuous improvement in security with every new software release informed by the vulnerabilities identified by static code analysis and the corresponding exploits being targeted at run-time.

We cannot keep doing things the same way and expect different results. So far, we have been reacting to threats and trying to play catch-up with cybercriminals. Unless we change our approach to cybersecurity -- and start incorporating security at the very beginning of development -- we will continue to fail.