Application Security Testing in the Development Lifecycle

00:05 Hi, my name is Greg Copeland from SYNNEC, and welcome to Cut to the Chase. Today, I'd like to talk to you about application security testing in the context of the continuous software development lifecycle. Application security testing is very important, and it has to be done at all the different phases of the software development lifecycle. It has to be done during development, during quality assurance, before an application is released to production,

00:35 as well as after production to make sure it stays secure. It's also important to integrate application security testing with our development process, so integrate development and security, otherwise known as DevSecOps. And in today's modern software development environment, applications are being updated more often than ever. So this is a cycle that's going to repeat often and very quickly. So being able to have continuous application security testing is very important.

01:05 And SYNNAC, to meet this need, is our Pen Testing as a Service platform or SYNNAC PTAS. I'm going to discuss that along with the different components of our solution and how it fits into the different phases of the development lifecycle and application security testing. So With that, I'm going to pivot and talk to you about some of the components and show you a demo of some of them as well. This one here is just a data sheet.

01:35 During development, you're going to want to analyze your source code. The source code could have known risks in it. You're going to look at the different lines of code and analyze if there are just some inherent vulnerabilities in the code itself, Even before you get to the point of testing the application and exposing it to users, you'll want to look at this. So Cynack has source code review. This can analyze

02:05 various different libraries. This is going to be too small to see here, but all the common software libraries are available. So you can have Synack do this type of testing for you. Now next I wanted to talk about the Synack platform itself and go into some of the other parts of the testing at the different phases of the lifecycle. While it's loading here, I have a moment.

02:36 And what we're showing here first is the high level dashboard. SYNNAC finds vulnerabilities. We call them exploitable vulnerabilities are the ones that are important. These are the ones that our human security researchers called the SYNNAC Rev team have actually been able to exploit in a safe manner and give you the recommendations to fix them so you can remediate before they can be exploited by bad actors. There are various ways to apply this technology.

03:08 And for example, at the quality assurance phase, you might want to start by checking some security benchmarks. So security benchmarks will go through a set of well known criteria. And we call them mission. So we call missions the specific test. So in this example, this one here for Microsoft, but we support all different types of environments. This set of benchmark missions will execute various tests. And these are checking for, if you will,

03:39 known vulnerabilities to see whether you're exploitable or not and then giving you findings back. These tests, by the way, consume credits in SYNNEX. So you'll have credits and you can apply them how you would like to check your application when you're in quality assurance. The results of those tests will be in the Missions Findings tab. Here is another one for a standard web application. There are various tests here. You can see that some of them have passed and some of them have failed.

04:10 So we can open one up, we can see the one that has failed. And along with some conclusions and some actions that could be taken to start closing those security gaps during quality assurance. And I should have mentioned this earlier, but one of the unwritten rules of software development is the earlier you can catch bugs and fix them, the less it's going to cost you. If you can catch them during development, during source code analysis, you know, that's not very costly.

04:40 During quality assurance, even if you can catch them there before production, it's going to save you a lot of time and money rather than doing it after. So we suggest with the SYNNAC PTAS platform to conduct some security benchmark testing early on to make sure you catch as much as possible. Now, once you have an application candidate about ready to launch, we also recommend conducting a full blown pen test. We call this an assessment. So you can run assessments against your various applications.

05:12 When you run those assessments, what you get back is a set of findings, which we call open vulnerability discovery. So these will be things that our Cynac Red team, our human led security researchers have been able to find. And you're going to see that they provide some very detailed findings. So beyond just kind of an automated response telling you CVEs, they're going to give you an impact analysis, tell you where you are vulnerable, give you exactly,

05:43 in this case, a web application, the HTTP request that was used to attack along with steps to reproduce and recommendations. So what this is going to provide to the developers is a lot of detail to give them specifics of what they need to do to close the security gap of this application before it is launched to production. That was one example. I can look at other examples here. This is another one for a price order API.

06:16 And we can support various different types penetration testing. We support web pen testing, we support host, we can pen test other applications, and even do some testing of mobile and APIs as well. APIs are becoming increasingly important. And by the way, we don't just provide the recommendations and then that's it. We provide the recommendations. And then once the customer has fixed it, we can put it into,

06:46 the customer can put it into a patch verification request, then it will go back in and SYNNET can retest and make sure that it is truly non exploitable at that point. Now we're ready, we can put something into production. So that's great. We put it into production, But we're not done yet because when an application goes into production, it's going to be exposed to external attack surface. It's going to be exposed to potentially

07:18 different access points. The application may be deployed unknowingly onto different cloud assets than we expected with different attack vectors. There may be things like third party components or other tiers that are communicating with it that expand that attack surface beyond what you could necessarily find during a quality assurance or prerelease testing. So as an example, I know we talked about a web application before.

07:49 In SYNNAC attack surface discovery, you have the option to create a discovery seed. And let's just take the example of, you know, if it was example dot com, it was my app. I put that in, it would start discovering assets around that. It would start discovering other things and we could decide whether we were going to include that into testing. So we'll go into an asset list. And this overview screen is kind of a convenient way to navigate this.

08:19 If it were a web application, I could look at the asset list and what we call asset insights. The asset insights are generated by some automated tools, including fingerprinting to tell you something about these applications and these assets that are associated with your application and where they might warrant more testing. So let's say for example, most of these, the customer says this looks good, This is what I'm expecting with my application. But this second one here in the list, they see it and they see the provider of Cloudflare.

08:52 They say, uh-oh, we don't use Cloudflare. No, why is this here? Why did it go here? So they could click on it. They could learn a little bit about it through our asset insights. They could look at some of the metrics such as who is, and they could also see whether Synack has tested it yet. So in this case, Cynack has not tested it yet. There's some doubt about what it is. So this is probably a good candidate to have Cynack do some additional testing. So at this point, it could be put back into the queue,

09:23 into the assessment, and it could be examined more closely. So that's the concept of applying Synapse Attack Surface Discovery and Asset Insights to part of the application security testing landscape for the software development life cycle. I could show some other examples here. There's various ways to categorize this. Now we could look at another one. Now we could see here, this one here has some exploitable vulnerabilities. It happens to be one that has been tested in the past by

09:55 SYNNAC, but it looks like this one maybe isn't closed yet. So we could go back and look at it and test it again as needed. Now, we talked about asset insights. Asset insights and running tests based on those. Again, this will feed into the exploitable vulnerabilities. These are the detailed actionable reports that you as a customer can take to correct these software vulnerabilities that could

10:26 occur after an application hits production. So again, we need to test at all phases, not just development and QA, but once it gets into production as well. And the SYNNAC PTAS platform, you know, of the beauties of it is it is really meant for continuous testing. It's not like a once a year pen test that is more for compliance purposes. This is available throughout the year. Tests can be run whenever needed. The critical applications could be continuously monitored to

10:56 make sure that new exploits that might arise during that timeframe are examined right away. So there's other components of the platform which I could show you. We've got some nice analytics now in the platform. We can look at the categories of the different types of vulnerabilities that are being seen. We can see here there are our top bones, cross site scripting seems to be a particular issue. So that might be an area to look at more closely.

11:26 We can also look at vulnerability response, how quickly things are getting remediated based on Synapse recommendations. Some of them are happening more quickly than others. And we have some other useful data such as trends. So the trends are telling us the amount of vulnerabilities over time. What we hope for is that we're getting fewer vulnerabilities. That means that our application is becoming more hardened over time. And SYNNEX pen testing as a service is a way to help achieve that.

11:58 We're always going to find new vulns. They're never going to go away. But the point is with SYNNEX, you find as many of these as possible and close the security gaps before a bad actor can exploit them. So with that, I've been staying in the Synact platform, and that's great. Your security practitioners are going to spend a lot of time there. And now what we also want to do is we want to look at this

12:29 from the point of view of the development practitioners as well. So the development practitioners, they're going to work in different tools such as Jira, for example. And what Synack has done is we've integrated through the Jira security program. So our vulnerabilities that we discover are going to be automatically synced to Jira.

12:59 And those will appear on the developers' projects. This is one way that they manage. There are different ways in Jira to navigate and use the Sync data. This is one of them. Just showing an example here. Vulnerabilities found by Sync, they can be put into the developer's backlog. Their developer is then going to get the details of the vulnerability and the recommendations from the tester with which they can take action. As they work through that, they can update the status from backlog to in progress.

13:31 And once they have fixed it, they can mark it as done. And all of these things, by the way, are synced by directionally between Jira and SYNNAC. So everything will stay up to date. But the point here is that this is navigating and making use of the application security testing from SYNNAC without the developer having to work directly in the security practitioners tool. So it gives a nice integrated workflow, which is very vital for having an effective

14:02 security and software development lifecycle. So once something is fixed, it shows over here, we have the details. And we can also then, once we say we've done it, we can send it back to SYNNAC for patch verification. So at that point, SYNNAC will test it again. They'll give a report back saying, yes, this vulnerability has been dealt with, the security gap is closed. So with that, that's what I had to show you today. I encourage you to contact SYNNAC to learn more about

14:34 SYNNAC's pen testing as a service platform and how we can help you with your application security testing in the continuous software development lifecycle. Thank you.