Table of Contents

1. Developers and students have to be told to pay attention to security
2. What if the study was conducted with web application developers instead?.
3. Shortcomings of SAST tools / Why is DAST the better choice for integrating application security into the SDLC
4. Shift security left with Bright

Developers and students have to be told to pay attention to security

Recent studies show that developers do not actively pay attention to the security of their code unless directed otherwise. Still, application security is fundamental from the early stages of app development.

All team members, including developers and QA people, involved in the product design stage, should at least be aware of the need for application security.

The University of Bonn researched two groups with 20 Computer Science students each. Researchers gave the students a task to develop a registration program for the university’s social network. One group was explicitly told to store user passwords securely while the other group was not.

The participants who were not told to store user passwords securely didn’t make any effort to implement secure code. In the other group, out of 20 participants, 12 applied some level of security.

What if the study was conducted with web application developers instead?

The team from the University of Bonn did the same research with freelance developers. They posted an advertisement on freelancer.com, pretending to be a start-up company. The researchers specifically asked for the assistance of developers with the registration function of a sample social network website. Forty-three applicants were split into two groups. One of the groups was again told to store user passwords securely, while the other group was not.

Out of 18 participants who failed to include a secure password storage mechanism, 68% belonged to the group that was not instructed to implement secure code.

The study conducted on freelance developers confirms the tendency of developers not to implement security measures for storing user passwords unless otherwise directed.

Specifically requesting developers to write secure code plays a critical role in the design of any application.

Developers have to follow development and news in web security. Otherwise, they will make risky mistakes, like using weak hashing algorithms.

As seen in the research by the University of Bonn, developers often use weak methods. They often use encoding or encryption instead of hashing or use inadequate hashing algorithms. Developers need to examine these terms to find out the meaning, capability, and limits of each.

If we want to have secure web applications by design, we have to educate students and developers about the best, the latest and most secure solutions. A lack of knowledge about handling and securing user data will cause confusion, and worse, open a back door for malicious users.

Shortcomings of SAST tools / Why is DAST the better choice for integrating application security into the SDLC

Despite having access to source code and being able to test code for vulnerabilities, SAST tools have significant limitations. SAST tools can detect many different vulnerabilities in the code, but everything they identify is in the code and may not exist in the compiled application, or may not be relevant in the combined application. As an example, they can detect the absence of access control, but they cannot verify if it is running appropriately in the compiled application based on the actual implementation. 

Another problem with SAST tools is that they produce high numbers of false-positive results. It’s difficult to verify whether or not some identified issues are actual vulnerabilities. This results in developers and security experts spending hours on end trying to distinguish between true vulnerabilities and false ones instead of focusing on resolving true vulnerabilities. Moreover,  If SAST tools don’t find any problems, it does not mean that your code is secure as they only look at the code and not at the compiled application, APIs, etc. Related to this is the fact that most applications today use 3rd party libraries and web-services. SAST tools do not have the ability to test vulnerabilities in web-services, thus leaving your application vulnerable.

The problem with false positives persists with the majority of DAST tools as well.  We are proud to say that Bright is one of the few DAST tools, if not the only one that will not report any false-positive findings. We validate that every vulnerability can actually be exploited before we report it.

Shift security left with Bright

Shift left is a simple term for a challenging task which is at the heart of DevOps. You need to move application deployment, quality and security considerations closer to the developer to ensure that potential issues are detected and resolved sooner as early as possible and at the lowest cost. CI/CD automation technology including CircleCI, Azure DevOps and others certainly makes shift-left easier.

As our previous post about the cost of remediating issues over time shows, the cost associated with bugs and security issues as they move through the delivery chain multiplies several times over at each step.

By addressing issues at the point of origin, shifting left has a clear ROI. In traditional development, dedicated teams are responsible for security and quality assurance. They generally respond to issues, not necessarily preventing them. Once the code is moved to integration or production, it is often too late to take precautionary measures. Also, IT teams are focused on system-level security, which is different than application security, where sneaky issues can be missed without security testing tools. 

Bright seamlessly integrates into your SDLC and enable developers and QA teams to run application security tests throughout the CI/CD process. By choosing Bright’s AIAST ® solutions, organizations are able to test for known and 0-day vulnerabilities and security scans can be run early in the SDLC.

Table of Contents

1. What has changed? – DAST Today
2. DAST & QA Functional Testing
3. Incremental Scans
4. Testing API’s & Web Services
5. Scanning Any Environment
6. Detecting Real-World Issues
7. Shifting Security Left

Dynamic application security testing – DAST is one of the oldest automated application security testing techniques, it has been around since the mid-1990s. DAST solutions interact with live web applications and web services, acting like a hacker-in-a-box. It has always been popular with penetration testers and security auditors looking to save valuable time.

DAST is generally focused on detecting high-risk vulnerabilities. It performs an “end-to-end” test of all the functionality across all layers of an application and provides a proof-of-exploit, making issues much easier to validate and remediate than other techniques, like SAST (code scanning). 

DAST solutions have been around since before Google existed. They continually struggled to find their place in the Software Development Life Cycle (SDLC) processes of most organizations until only a few years ago.

What has changed? – DAST Today

So, what brought on this change?  The answer is simple – DevOps. 

Collaboration between the security team, developers and DevOps is essential for security teams to enable the DevOps process. Through this collaboration, the DevOps process is transformed into DevSecOps.

This removes all the barriers that stood in the way of fully integrating DAST into the SDLC…

The automation of DAST as a part of the DevOps CI/CD pipeline offers a more reliable starting point for applications to be designed and implemented with proper security requirements.

Here are some common use cases in which DAST automation is very beneficial:

DAST & QA Functional Testing

Automating the use of DAST  by leveraging functional test tools such as Selenium provides significant benefits. The purpose of QA automation tools is to test the application’s functionality and provide quality code with proper UX. By integrating DAST tools as part of this process you not only ensure quality code, but you provide secure code as well without any additional work.

Incremental Scans

Modern development practices rely on the delivery of small incremental pieces of code that are deployed faster than ever. 

Developers continuously run unit tests to ensure quality code is deployed. DAST can be seamlessly integrated into these functional tests enabling incremental security scans of new or updated functionality and reducing the time and effort security testing time.  Moreover, enabling developers to detect security vulnerabilities during the development process enables them to resolve issues very quickly, whereas it takes much longer to resolve these issues if they are detected weeks, or months later.

Testing API’s & Web Services

RESTful API’s and web services comprise a large percent of the code used in web applications. Since this code doesn’t have UI/frontend, organizations usually neglect to test it making them more exposed to cyberattacks. Integrating DAST into functional tests enables them to interact with each web service and API calls to detect and validate vulnerabilities.

Scanning Any Environment

One of the major advantages of DAST over SAST  is that it doesn’t care what language is used to write an application. Whether it is Java, .Net, Phyton, C, Cobol, or any other language, or if you use MySql, Microsoft SQL server it doesn’t matter. Our AI-powered DAST solution is able to scan any target including HTTP/HTTPS, web socket, rest API to test the APIs themselves. This even extends to protocols such as Bluetooth, and FIX for financial institutions.

Detecting Real-World Issues

Over the past few years, microservices have become the leading method of application development. Modern apps are made up of multiple systems and components built by multiple teams and often multiple companies.

Since DAST scans applications and services in their running environment it is able to detect real-world vulnerabilities when microservices are used without the need to scan each component individually.

Learn about the top challenges of microservices security:

Shifting Security Left

The value DevSecOps offers is to conduct security testing earlier in the software development lifecycle. It enables to shift of testing left by adding security planning, testing, and monitoring into each phase of the DevOps pipeline.

Developers are under constant pressure to release as quickly as possible.  Organizations can shift security left by integrating DAST into their existing environments, rather than relying on security testing at a later phase when the developer has moved onto something else.

Automating DAST into the process is critical for enabling DevSecOps. Release and scan as early and often as possible and ensure security throughout the entire software development life cycle. This will save both time and money without affecting development velocity.

Table of Contents

1. What is industry 4.0?
2. IoT – Internet of Things
3. Blockchain
4. AI – Artificial Intelligence
5. The Way Forward

In the era referred to as ‘Industry 4.0’ or ‘The Fourth Industrial Revolution,’ two of the pillars of the technology field;  automation and data transfer are closely coupled with concerns regarding cybersecurity.

As organizations own, or use more and more information and assets which become additional nodes in the network, the attack surface area increases exponentially. As a result,  cybersecurity aspects are transforming at an unprecedented rate. The challenges to security are becoming more prominent than ever, with both sides– hackers and security teams – trying to stay ahead of each other. In today’s hyper-connected world, cyberattacks are no longer a matter of “if”, but rather “when”.

As the use of computers and automation led the charge through the last few decades, organizations and governments focused their efforts on investments in the IT infrastructure era, which is referred to as ‘Industry 3.0’.

However, today, the focus has shifted to new technologies such as IoT (Internet of Things), AI (Artificial Intelligence), machine learning and reinforcement learning which are defining the new work culture across almost all industries. Industry 4.0 essentially blends automation with advanced AI to reduce direct human effort and resources. The result is a more efficient utilization of both financial and material resources.

In the era of the Fourth Industrial Revolution, organizations are hyper-connected with smart devices and smart networks. This poses  a very lucrative target for hackers who can try to exploit the significantly higher number of vulnerable entry points into networks and devices. . Cyberattacks on critical infrastructure and in vital industrial sectors have become more frequent and more sophisticated.

Internet of Things describes a world in which smart technologies enable objects within an intelligent network to communicate with each other and interface with humans effortlessly. 

This connected world of accessibility and technology does not come without its consequences, as interconnectivity implies hackability. Most of these devices are designed with little to no built in security mechanisms, making them easy targets for security breaches. This new world of convenience calls for new and revolutionary protection measures and strategies to assure secure networks.

Blockchain

As a concept, blockchain has been around for approximately a decade. It is a well understood and defined concept that forms the backbone of most common cryptocurrencies. Blockchain, as a technology, focusses on the integrity and immutability of transactions. While blockchain as a technology is evolving, it offers solutions that can compete with current centralized offerings in terms of speed, but the blockchain is much more reliable considering capacity and trust. Inevitably, in IoT, blockchains will be used to secure infrastructure while maintaining device interoperability.

Although blockchain holds immense promise and potential, it remains vulnerable to cyber threats and risks. A robust cybersecurity program is therefore crucial for protecting blockchain assets from cyber threats.

Artificial Intelligence is another technology that is rapidly permeating organizations and government departments. It is a branch of  computer science that helps to build solutions with human-like intelligence that can carry out complex tasks independently. 

AI applications are based on heuristics such as neural networks, machine learning, deep learning and natural language processing algorithms. Machines mimic humans only after they are trained to accomplish specific activities by processing vast amounts of data and identifying patterns in that data. The growing interest in these technologies and the value they offer is resulting in their adoption across many aspects of software and IT..

AI has the potential to make cybersecurity more efficient and responsive to ever-increasing threats and improve the cybersecurity posture of an organization

The more industries become connected, the more vulnerable they are to the risk of cyberattacks because there are significantly more entry points for hackers to find and exploit. Hackers can target the connected devices that generate data, the networks that carry the data, the servers that host it, or the information systems that use it. 

AI has the potential to make cybersecurity more efficient and responsive against ever-increasing threats and improve the cybersecurity posture of organizations. Being the world’s first AI-powered Application Security Testing platform, Bright helps innovative companies that are in the forefront of the Industry 4.0 era significantly reduce cybersecurity risks. 

Cybersecurity should never be an obstacle to progress. Bright’s AI powered application security solutions help organizations save time and eliminate the security personnel bottleneck while reducing costs and their exposure window by being secure by design. 

To learn more about how you can adopt these tactics in your organization and embrace the fourth industrial revolution, or you have any questions on how to become secured by design contact us today.

Table of Contents

1. The Average Cost of a Data Breach
2. Healthcare is the most expensive industry when it comes to data breaches
3. The most expensive country to experience a data breach
4. Some of the biggest data breaches
5. U.S Office of Personnel Management
6. Exactis
7. Yahoo!
8. Equifax
9. Epsilon
10. TJX
11. Marriott
12. Sony Playstation Network
13. Uber
14. Veterans Administration

The Average Cost of a Data Breach

For the 14th year, IBM and the Ponemon Institute have released their annual “Cost of a Data Breach” report, aggregating the costs reported by 507 organizations, from 17 industries, and 16 regions. IBM and Ponemon interviewed 3,211 individuals and collected data points regarding the number of client records stolen or lost in breaches, how the organization responded to the breach, and how their business did after the breach.

According to the report, data breaches cost $150 per record this year. Last year the average cost of a data breach was $148 per record.

The cost associated with a data breach can span anywhere from $1.25 million to $8.19 million depending on the country and the industry.

Healthcare is the most expensive industry when it comes to data breaches

The healthcare industry continues to be susceptible target for attackers when it comes to cyberattacks. Healthcare breaches are the most expensive and cost an organization $6.45 million per breach. For the ninth year in a row, healthcare organizations have had the highest costs associated with a data breach.

The average cost per breached healthcare record ($429) is more than double any other industry and substantially higher than the average $150.

Healthcare breaches can often take the longest to identify. It can pass up to 236 days before a breach is detected. Additionally, the healthcare industry, followed by the financial and pharmaceuticals industries, had the most significant difficulty retaining customers following a data breach.

The report breaks down every angle of a data breach, detailing how having mitigation in place can reduce the cost of a data breach. Having an incident response team or using encryption alone can reduce the cost, but by having both in place, a company could potentially decrease the cost of a breach by $720,000.

By having security automation deployed, companies experience around half the cost of a breach. Companies that have incident response teams, security testing tools, and security automation deployed could save $1.23 million per data breach on average.

The most expensive country to experience a data breach

The most expensive country to experience a data breach are the United States.

In the U.S., the average cost of a data breach increased from $7.91 million in 2018 to $8.19 million in 2019. That’s more than twice the global average.

The average number of records per breach is the highest in the Middle East and India.

Some of the biggest data breaches

Data breaches can affect businesses of all sizes, and in deed, some big companies and organizations suffered attacks in the past. Although large companies survive data leaks, they suffer great material and reputational losses. The problem becomes bigger with small and medium-sized companies where the result of a data leak can be devastating to them and mean the end of their business. 

We gathered just some of the biggest data leaks in the past.

U.S Office of Personnel Management

COST: $500 million to several billion
IMPACT: 4 million people, 21.5 million records

The United States Office of Personnel Management (OPM) reported that it had been the target of a data breach. Federal officials have described it as among the largest and most critical breaches of government data in the history of the United States. The data breach consisted of two separate, but linked attacks. The first attack was discovered on March 20, 2014, but the second attack was not found until April 15, 2015. FBI arrested a Chinese national suspected of helping the creation of the malware used in the breach.

Exactis

COST: $242.7 million
IMPACT: 200+ million U.S. consumers and 110 million business contacts

Exactis, a marketing and data aggregation firm, was the subject of a data breach in which customer information ended up on the internet. The stolen data includes phone numbers, addresses, emails, and other information — like interests, habits, and the number of one’s children. Hackers frequently use this type of information to steal identities and break into accounts.

Yahoo!

COST: minimal $470 million
IMPACT: 3 billion user accounts

Yahoo! suffered two significant data breaches. The records contained names, email addresses, telephone numbers, encrypted or unencrypted security questions and answers, dates of birth, and hashed passwords. Yahoo! has been criticized for its late disclosure of the breaches and their security measures. The breaches impacted Verizon Communications’s plans to acquire Yahoo! for about $4.8 billion. The FBI officially charged four mean for the 2014 breach, including two that work for Russia’s Federal Security Service (FSB).

Equifax

COST: $439 million to 4 billion
IMPACT: 148 million Americans, 209,000 credit card numbers

Equifax announced in September 2017 that its systems had been breached and sensitive personal data had been compromised. The data included names, home addresses, phone numbers, dates of birth, social security numbers, and driver’s license numbers. The Equifax breach is unprecedented in scope and severity. There have been larger security breaches by other companies in the past, but the sensitivity of the personal information held by Equifax and the scale of the problem makes this breach unprecedented.

Epsilon

COST: $270 million to 4 billion
IMPACT: 60 million users

Epsilon – the largest permission-based email marketing company, suffered a data breach. The breach was a result of an “unauthorized entry” to Epsilon’s email system. Companies like Walgreens, BestBuy, CitiGroup, JPMorgan, Capital One and others were all affected indirectly, as they were clients of Epsilon. No personally identifiable information was obtained, but the emails they got could be used for spam and phishing attacks.

TJX

COST: $256 million
IMPACT: 94 million customers

Intruders gained access to TJX’s computer systems. The breach affected 94 millions of retail shoppers.  Customers’ MasterCard and Visa cards had been compromised. Debit card PINs weren’t compromised, but hackers gained access to unencrypted magnetic stripe data. Several banks sued to recoup losses related to the breach.

Marriott

COST: $200 million to $1 billion
IMPACT: 500 million customers, 383 million guest records, 18.5 million encrypted passport numbers

Marriott suffered a massive data breach. Information accessed included payment information, names, mailing addresses, phone numbers, email addresses and passport numbers. Details included 9.1 million encrypted payment card numbers and 385,000 valid card numbers in addition to 5.25 million unencrypted passport numbers.

Sony Playstation Network

COST: $171 million to $2 billion
IMPACT: 77 million accounts

Sony suffered a data breach that exposed the names, addresses and other personal data of their users. An “Illegal and unauthorized person” got access to people’s names, addresses, email addresses, birthdays, usernames, passwords, logins, security questions and more for two days. Sony stated that it saw no evidence that credit card numbers were stolen, but advised users they credit card numbers and expiration date may have been obtained.

Uber

COST: $148 million
IMPACT: 600,000 Drivers

Uber suffered a breach and concealed the hack for more than a year. The hackers were paid $100,000 by Uber to delete the data and keep the breach quiet. Driver’s license numbers of around 600,000 drivers in the U.S., names, email addresses, and mobile phone numbers were stolen. Uber agreed to pay $148 million in connection with this data breach and subsequent cover-up.

Veterans Administration

COST: $100 million to $500 million
IMPACT: 26.5 million people

A Veterans Affairs data analyst took home a laptop and an external hard drive containing unencrypted information on 26.5 million people. The laptop and hard drive were stolen in a burglary of the analyst’s home. The employee admitted that he had been routinely taking home such sensitive data for three years. The stolen data included names, Social Security numbers, dates of birth, and some disability ratings.

As the cost of insecure applications grows more and more evident by the day, are we doing everything we can and should, to mitigate the risk?

Implementing an information security awareness policy will enable you to impose security responsibilities as part of your corporation’s security protocols and practices.

What is Security Awareness?

Workplace Security Awareness is a proactive approach to the dangers of online or offline threats. 

A good security awareness program should educate all employees, especially developers, about incorporating security best practices. Companies willing to shift their security mindset and offer their employees security training, can enhance the safety of their business, workforce and more importantly their customers and their data.

What is security assessment that you need to be aware of?

Whether we are looking at lost customer data, misplaced data, or unauthorized system access, typically it is not a case of “if” but “when” something is going to happen that puts your company at risk. In order to understand how to establish a prevention model, we have to understand the most common mistakes that people make so that the appropriate training can be provided for prevention and / or countermeasures can be put in place to protect or defend against such attacks. 

Security is a tug of war between keeping safe, whilst not impacting on the business commercially, as well as maximising UX and customer convenience, which always takes a leading role. If the system incorrectly classifies a user as a threat and blocks certain user activities that the system deems are putting the organisation at risk, customers get frustrated resulting in relaxed security protocols to maximise customer convenience and usability, without fully understanding or measuring the risk to reward ratio.  

Similarly, security can often take a back seat in the development cycle, particularly if impacting the DevOps process and speed.  As more and more organisations are shifting security left, enhancing DevSecOps, developers acquire more responsibility of this process, with the hope of detecting and remediating vulnerabilities early, being secure by design and minimising the window of exposure.

Don’t blame the developers

The continual battle between development and security is a well known one.  Focussing on today’s business priorities, developers do their job very well – developing the software as fast as possible to meet tight business release dates to maximise revenue and profits. Bugs appear in the code not because developers are lazy or don’t care about code quality and security, but because the business prioritises the fast delivery of working code over the delivery of secure code at a slower pace.

No developer likes being told that their code is insecure, especially 6-12 months after it was written, often leading to resentment and additional procrastination. The truth is that the sooner these tasks are completed and vulnerabilities remediated, the sooner the application can become properly secured.

In order to develop more secure code, organisations need to incorporate testing into the software development life cycle (SDLC) and train their developers to write more secure code. By being able to effectively understand what vulnerabilities appear more often and by which team or which developer in a particular team, additional training can be provided so the same mistakes don’t feature again.

DevSecOps through Automation – Detect more and often

Developers are under constant pressure to release as fast as possible mainly in agile environments. Organisations can shift security left by integrating automated security testing tools (such as Bright)  into their existing environments, rather than relying on security testing at a later phase when the developer has moved onto something else.

AppSec testing tools on the market today have many limitations, only able to detect known vulnerabilities, carrying out simple trivial attacks whilst trying to determine if the application is exploitable or not, often with incorrect results – the infamous false positive issue. As a result, developers are overwhelmed with unnecessary workloads, unable to prioritise vulnerabilities for remediation, impacting on the DevOps speed. These tools then need to be complemented by lengthy and expensive manual testing, typically carried out periodically a few times per year. This lack of automation slows down the whole development and release process, while also impacting on any awareness training on the go.

By automating manual processes and building tools into the CI/CD (continuous integration and continuous delivery) pipelines, development, operations and security teams can increase workflow efficiencies and trust between groups. 

Automation is key to the DevSecOps approach: test as early and often as possible, get accurate actionable results, ensuring security throughout the entire software development life cycle,  enabling organizations to bring high-quality, secure features and improvements to the market faster.

Bright’s AI-powered Application Testing Suite of Solutions delivers an immediate DevSecOps environment with integrated and automated AppSec testing. Developers can benefit from our tools that fully integrate into the agile development or indeed Unit Testing processes, empowering them to detect, prioritize and remediate security issues EARLY and learn from their mistakes so that the same coding malpractices are not repeated.

Contact us today, or request a DEMO to discuss your requirements with us, we are more than happy to help you Shift-Left!