DevSecOps

The Age of DevOps

The Most Valuable Resource of All: Time

This post was authored by Paul Asadoorian, CEO and founder of Security Weekly.

Over the last twenty years we have witnessed dramatic changes in the way companies write and ship code. First there was Waterfall, followed by the Agile movement in the early 2000’s, and now we find ourselves in the Age of DevOps. All of these changes have been made with one goal in mind: ship more code in less time. After all, time is the great equalizer for us all – and those that do more in less time will always find themselves in a favorable state.

As it relates to security, time is the hardest resource to come by. There is always more to do, never enough people to help, and hardly enough budget to purchase the tools necessary to buy more time. During those early days of security when Waterfall development reigned supreme, there always seemed to be enough time for security practitioners to stop that next push to production. The company waited 6 months (and sometimes up to a year) to deliver new features to customers – what’s another few weeks?


Credit: CommitStrip (https://www.commitstrip.com/en/2014/04/15/the-original-code/)

 

Moreover the Internet was just starting to pop-up in homes across the United States, and the input vectors for web applications were fairly simple. The first web application firewalls (WAF) built by Perfecto Technologies in 1999 could surely handle pre-determined sets of inputs as potentially malicious – all done through the use of rudimentary tools like regular expressions to determine when someone was breaking bad on the Internet.

Unfortunately for us security professionals trying to adapt and evolve the way we stay ahead of attackers, the underlying code that runs modern day WAFs continue to replicate the antiquated solutions that harken back to the turn of the Millennium; these newfangled “CDN-Based Web Application Firewalls” are really just regex-based technology with a new coat of paint. Moreover, when your vendor tells you “there is no need to update or patch, you’re secure!” when a new Remote Code Execution vulnerability is disclosed – be skeptical. Although their latest regex might protect you from that shiny-new Proof of Concept exploit, they certainly aren’t protecting you against the polyglot exploits that are cropping up all over the place. This gaping hole in edge-based Firewall tech does us all a disservice in trying to address our most sought after need – time.


Credit: XKCD (https://xkcd.com/1171/)

 

Shifting Security and Buying Time

When it comes to buying time for your DevOps teams to finish that new feature, the best thing you can do is put your security protections as close to the application as you can – and to ensure that the data and metrics you produce are readily useful to Development, Security, and Operations teams. What’s more, you need this protection to be fast, lightweight, and reliable – i.e. not regular expressions; and moreover, you need it to block a variety of attacks beyond the OWASP Top 10 – including account takeovers, bad bots, application denial of service, and more. The only player in the space today with experience producing security results that scale in a DevOps environment, while also providing fast response times with lightweight installation and deployment is Signal Sciences. If you don’t believe me, the proof is in their ability to deliver security at speeds unmatched by their competitors – allowing development teams to focus on delivering value to your customers, and security teams to prioritize remediations during the next sprint.

Paul Asadoorian

Paul Asadoorian is currently the Principal Security Evangelist for Eclypsium, focused on firmware and supply chain security awareness. Paul’s passion for firmware security extends back many years to the WRT54G hacking days and reverse engineering firmware on IoT devices for fun. Paul and his long-time podcast co-host Larry Pesce co-authored the book “WRTG54G Ultimate Hacking” in 2007, which fueled the firmware hacking fire even more. Paul has worked in technology and information security for over 20 years, holding various security and engineering roles in a lottery company, university, ISP, independent penetration tester, and security product companies such as Tenable. In 2005 Paul founded Security Weekly, a weekly podcast dedicated to hacking and information security. In 2020 Security Weekly was acquired by the Cyberrisk Alliance. Paul is still the host of one of the longest-running security podcasts, Paul’s Security Weekly, he enjoys coding in Python & telling everyone he uses Linux.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.