Agencies can build robust web application security through continuous, comprehensive and automated scans across their entire attack surfaces.

Web applications and application programming interfaces (APIs) play a pivotal role in modernizing the delivery of services and communication between citizens and government agencies. However, according to Verizon’s annual data breach study, web applications have become a primary point of attack by hackers.

For public sector organizations that have modernized using web applications, it has become critical to move beyond periodic or point-in-time vulnerability reviews and implement automated application security programs to bolster the defense against rising cyber incidents.

Government organizations face unique challenges that set them apart from the private sector. Long-lived legacy systems with web interfaces and APIs of varying vintage woven in create hurdles when implementing timely updates and patches to enhance security. Unlike commercial sectors that can adopt technology improvements relatively quickly, government agencies often struggle to keep pace due to their reliance on older applications or systems. However, agencies can begin to address new and emerging threats by seeking a more thorough understanding of the attack landscape and acquiring available tools essential to navigate these challenges.

“We need a comprehensive understanding of any potential attack scenarios at play; we need to understand who has access to these applications, the nature of these applications themselves and their sensitivity levels, and then tailor our decisions accordingly. The challenge magnifies when dealing with legacy systems, as they resist easy modifications or swift updates,” says Invicti Security Chief Technology Officer Frank Catucci.

“In certain instances, the latest versions of software might be inappropriate because they’re perhaps older components or things that are critical for infrastructure or business functions that can’t be disrupted as well. So, in that case, rigorous testing becomes imperative. And we need to understand, without a lot of noise, where the real risks lie,” Catucci adds. Identifying all the potential vulnerabilities is critical as more and more applications move to the web and into a much more exposed state.

We need a comprehensive understanding of any potential attack scenarios at play; we need to understand who has access to these applications, the nature of these applications themselves and their sensitivity levels, and then tailor our decisions accordingly. The challenge magnifies when dealing with legacy systems, as they resist easy modifications or swift updates.

Frank Catucci, Chief Technology Officer, Invicti Security

Syncing security with development

Because APIs act as gateways to valuable data, they’ve evolved into significant attack surfaces. Developers increasingly rely on APIs in their applications, so the need for solutions that efficiently identify vulnerabilities within APIs has become crucial.

“The deliveries of modern applications are moving at a much greater, more frequent cadence, meaning that we’re not releasing the software once a quarter or once a year, like our more legacy applications. We’re releasing multiple times a day for the more modern types of applications and APIs. So, with that, we really need to look at this from a different perspective,” explains Catucci.

“Modern applications are going to have a different threshold, meaning that things are changing multiple times a day in a rapid fashion. We cannot wait for those point-in-time scans. To accommodate this rapid pace of change, there needs to be a shift in perspective towards integrating security practices into DevOps processes,” he adds.

The average data breach cost in 2023 was $4.45 million.

To stay ahead of those potential costs, periodic scanning of web applications and APIs is insufficient. Modern web application development requires a strategy that balances speed, accuracy and increased testing frequency.

Adopting solutions that integrate into the software development cycle (SDLC)—like dynamic application security testing (DAST), interactive application security testing (IAST), or software composition analysis (SCA)—provides comprehensive coverage for applications in development and production, yielding accurate results and reducing manual work.

And these testing solutions are not a one-and-done effort. As code changes or evolves, new vulnerabilities can appear, and old ones re-emerge, making regular and automated testing a necessity. According to Invicti’s AppSec Indicator, “Scanning has been steadily increasing year-over-year since 2019. There was a 50% increase in scan frequency per account over the last four years, showing a trend of companies scanning more internal and external web apps and APIs at a greater frequency as they expand security testing left (in development) and right (in production testing).”

Additionally, the report found that while the scanning increased, there was a decrease in the percentage of severe vulnerabilities, dropping nearly 20% in 2022. The data indicates that dedicating resources to enhance application security programs that incorporate scanning or testing at various stages of the SDLC is yielding positive results. The uptick in scan frequency led to a decline in scans revealing critical vulnerabilities, according to the report. Consequently, this lowers the risk of exposure for organizations. And as the pace of software development accelerates, application security initiatives should embrace a dual approach—expanding security measures to both earlier and later stages of the development cycle to mitigate the potential of data breaches.

Modern applications are going to have a different threshold, meaning that things are changing multiple times a day in a rapid fashion. We cannot wait for those point-in-time scans. To accommodate this rapid pace of change, there needs to be a shift in perspective towards integrating security practices into DevOps processes.

Frank Catucci, Chief Technology Officer, Invicti Security

Alleviating pain points from top to bottom

When equipped with the right modern solutions, AppSec engineers can conduct scans and share their findings with the DevOps team without having to directly engage in the more intensive tasks of validating and addressing those vulnerabilities. The value of these findings lies in their ability to determine whether a quick and standard solution suffices or if a more prolonged phase of investigation and iterative communication is necessary, spanning weeks or even months.

Integrating this process seamlessly into the DevOps workflow yields cost savings by highlighting security concerns at their earliest stages. This proactive approach prevents the potentially expensive need to define, implement and retest fixes during later project phases.

Advantages of scalable security testing tools

DAST, a technology-agnostic testing method that doesn’t require source code access, is particularly important for securing web environments encompassing both legacy and modern applications. This is valuable for government organizations, where application lifecycles tend to stretch longer than in commercial contexts, and where systems and processes can be siloed to the point that it’s hard even to start a conversation about a standard security solution.

By incorporating testing with proof-based assessments into the development pipeline, organizations can improve security over time, detecting vulnerabilities before they impact production. The proof is in the numbers: According to Invicti’s research, proof-based scanning can confirm 94% of major exploitable vulnerabilities with 99.98% accuracy. Proof-based scanning cuts through the uncertainty by showing which issues are real and exploitable and cannot be false positives. This eliminates guesswork and manual work, enabling the move to fact-based web application security at any scale.

Additionally, agencies should look at solutions offering flexible deployment options across diverse environments—whether on Windows or Linux systems; containerized deployment using tools like Docker and Kubernetes or software-as-a-service (SaaS) in the cloud; and hybrid configurations in between. This enables time-strapped teams to incorporate security into their existing environments and workflows, ensuring effective, consistent testing and centralized visibility.

Converging traditional and cloud security

Another development Catucci is starting to see is the convergence between traditional application security and cloud security. Many agencies are adopting cloud and containerized environments to gain scalable and on-demand bandwidth benefits over traditional on-premises networks. This has resulted in exponential migration to and development of web applications that are more easily supported in these types of environments. Consequently, ensuring their security requires web application and API security testing in pre-production and production settings.

Addressing this expansive landscape requires a holistic approach, encompassing people and processes. “AppSec is not new, cloud security is not necessarily new; leaders need to understand the convergence of bringing them together. You can’t have these two siloed groups working (apart) anymore,” says Catucci.

He explains that adapting security practices for agile, cloud-centric modern application development involves integrating security throughout the process, embracing zero trust principles and ensuring that people and processes are integral components of a comprehensive security journey.

Strategies for building a successful AppSec program

Securing application workloads calls for orchestration, automation and governance that can only be provided by modern web application security testing solutions. To accelerate those efforts, Catucci recommends that agencies:

• Partner with renowned commercial cybersecurity vendors to work with mature security solutions and ensure vendor support for smooth implementation, integration and customization.
• Embrace a DevSecOps approach with automated security testing and consider testing solutions like Invicti’s to effectively secure numerous websites, applications, and APIs.
• Understand attack surfaces by mapping cloud-based data, open-source components, and online resources, including maintaining a software bill of materials, to identify potential vulnerabilities and access points.
• Regularly update, test and maintain your incident response plan to identify and address gaps, ensuring cyber resiliency across various potential scenarios while implementing a comprehensive data backup policy and restoration testing to mitigate the risk of data loss effectively.
• Instill a culture where every employee and contractor recognizes their role as the first line of defense by prioritizing cybersecurity awareness and education as an integral part of your agency’s everyday operations.

Learn more about ensuring your application security posture in the long run

This report was produced by Scoop News Group for FedScoop and DefenseScoop and underwritten by Invicti Security.