Web application security testing at scale with Coverity SAST

Remember the saga of Equifax and the unpatched Apache Struts vulnerability? It wasn’t that long ago, and it’s one of the most notorious web application security incidents to date.

As more devices and applications are connected to the web, malicious hackers get more targets in which to find vulnerabilities and exploit them. According to the Verizon 2020 Data Breach Investigation Report, 43% of the breaches were caused by attacks that started on web applications. Since the COVID-19 pandemic began, the FBI has reported a 300% increase in cyber security attacks. Managing web application security at scale to prevent data breaches has been top-of-mind for many CISOs for a while, and the pandemic has only emphasized that necessity. 

It has always been a race between CISOs trying to ensure that hackers don’t get access to an organization’s sensitive data via web applications, and hackers finding that one missed or unpatched vulnerability that will get them the access they want. The difference is, to prevent any such incidences, CISOs need to ensure that their risk assessment is right every time—but hackers only need to find the right vulnerability once. That’s why CISOs need to instill a security mindset in everyone, starting with developers.

Shifting security testing left

“Shift left” terminology has been used in the industry for a while. It refers to starting security testing early in the development cycle—i.e., from the developer’s desktop. However, security teams have consistently struggled with developer adoption and tool fatigue. Static application security testing (SAST), also referred to as static analysis, can help security teams with developer adoption. A SAST solution that can find security and quality issues by analyzing source code automatically, quickly, and accurately with low false positives would be the right solution for increased developer adoption. A SAST solution should also integrate into the developer’s IDE and SCMs, where they work regularly. It should analyze source code in the background, without interfering with their workflows, and it should provide accurate defect findings with remediation advice to improve developer productivity and help organizations achieve their security objectives.

Oversight into application risks

For security managers, a centralized dashboard that compiles the findings produced by static analysis and provides a high-level overview into application risks serves as a platform for continuous visibility into their application portfolio. Such a dashboard should enable security managers to generate reports against industry-recognized priority lists and application security standards, so they can assess and demonstrate compliance. A SAST solution that can identify these security risks, and ensure compliance to industry standards, can help development and security teams prioritize resources to fix the issues that matter most to them and minimize risks in their web applications.