We live in a world where 84% of software exploits happen at the application layer. Yet we continue to rely on vintage security techniques at the network layer to protect enterprise applications and the millions of users that use them.
Whether your organization uses a WAF, RASP, or a combination of SAST, DAST, or IAST, the only reliable approach to address these vulnerabilities is to patch the codebase.
Still, we make assumptions about risk in the form of heuristics that require a significant amount of manual investigation. Today enterprises deploy code multiple times a day, and Security teams must keep pace with each deployment where each code change can introduce new and previously patched vulnerabilities.
Three factors make this increased speed unsustainable for Security teams:
- Fixing vulnerabilities is manual
- Existing tooling adds noise rather than value
- Code changes lead to vulnerability regressions
This never-ending effort keeps them running on a metaphoric treadmill where they move fast but go nowhere.
The reality is simple – the current approaches are not sustainable for security professionals. If you need proof that the status quo is no longer adequate, look no further:
- A record-breaking number of 1,862 data breaches occurred in 2021.
- Gartner predicts that 99% of successful cyberattacks will continue to result from known but unpatched software vulnerabilities.
- NIST adds a new software vulnerability to the National Vulnerability Database every 30 minutes on average.
A 2022 report from Palo Alto Networks stresses how hackers start scanning for vulnerabilities within just 15 minutes once a new CVE is published.
With hackers becoming more dangerous than ever in recent years, it can take them mere minutes to find a weak point in their target’s applications.
In contrast, the average time to fix these critical software vulnerabilities sits at an all-time high of 205 days.
If traditional cybersecurity approaches aren’t decreasing the frequency of attacks or the time it takes to patch the vulnerabilities, how do we, as a community, improve our approach?
Introducing Security-as-Code
Security-as-Code (SaC) is the practice of leveraging machine-readable definition files that use high-level descriptive coding language to apply immutable and continuous security behavior.
This approach drastically reduces reliance on human intervention and grants security teams autonomy while allowing engineers to focus on development rather than vulnerability remediation.
While Security-as-Code is still in its early days, many resources are available despite a need for more consensus around what exactly it is. The issue with these resources is that their content could be more organized and less self-serving.
There needs to be a clear and objective path to Security-as-Code knowledge. To be as objective as possible, we’ll use Infrastructure-as-Code as a blueprint for Security-as-Code.
Using Infrastructure-as-Code as the blueprint means there are three key pillars that any SaC solution needs to exemplify three key pillars:
- Immutability – The security provided to your applications and APIs cannot be transient
- Scalable – The security provided must remove technological and human capital barriers to securing every application and API
- Performance – The security provided shouldn’t impact the user experience or incur a heavy hardware costs
This whitepaper aims to provide a clear starting point to Security-as-Code knowledge. We make a conscious effort to describe Security-as-Code objectively and optimistically for what it can be.
Download it to learn more about these key pillars, how Security-as-Code works, and what you can do to implement it.
