AppSec Best Practices



Here are 6 Steps for you to consider as you build and mature your AppSec program.


 

1

Identify Admins and Establish a New User/Team/App Workflow


Creating new users, teams, or applications is likely to be a common occurrence for any AppSec program, specifically as you are getting started. Identify which internal individuals (security champions) will be responsible for these critical workflows, ensuring operations can keep moving without interruption. Don’t start your developers off with a confusing first access process, or risk decreasing their desire to utilize the important tool. 


Reference Managing Users for how to manage users and teams and Platform Administration for how to create and manage application profiles.


2

Identify and Enable Security Champions 


Administrators will handle the admin functions of the system, such as creating new users. But it’s also critical to have “super-users” of the system – we call them Security Champions here at Veracode. These security champions can help guide fellow teammates on the ins and outs of Veracode’s AppSec solution. While Veracode has many resources to assist users, experience has taught us that new users most often want to learn from peers. 


Your Security Champion will join calls with your Veracode Account team and attend demo sessions in the Community for any products you will be using.


Furthermore, make sure Security Champions have easy access to any Veracode materials needed to get started. A few resources we suggest are:




3

Get Baseline Scans Kicked off ASAP for All Apps


Understanding current security posture is critical to the start of a successful AppSec program. Flaw counts can vary wildly for apps being scanned for the first time, so make an effort to get this baseline information as early on as possible.



4

Establish a Remediation Strategy/Workflow


While everything we’ve discussed until now has been important, one could say that this line item stands head and shoulders above the rest: Flaw remediation. Determining how your team(s) will tackle flaw remediation will be critical to the success of your overall program. Here are a few things to consider: 


Timing/Assignment

  • Will remediation work be part of all sprints or part of dedicated tech debt reduction periods?  
  • Will specific developers be assigned to address all security related issues, or will each developer be expected to keep their own code secure? 
  • HINT: The data tells us that it’s A LOT easier (and cheaper when considering total development time required), to fix flaws as soon as they are introduced by the developer who wrote the initial code instead of further down the line by a different developer. 


Policy

  • Setting policy is essentially setting the bar for your developers in terms of what needs to be fixed most urgently. 
  • Veracode classifies all flaws with an associated severity level. Sorting flaws by severity and exploitability is a best practice when working through flaws – start with very high, and highly exploitable flaws and work from there. If unsure, we generally recommend starting at the “Veracode Recommended Medium” policy and increasing the stringency of the policy as flaws/vulnerabilities are remediated. 
  • Custom policies can also be set at any time, once you have a better grasp on your program goals.  
  • IMPORTANT NOTE - Regardless of the policy set, all flaws within your application will be reported in the Triage Flaw view. Policy is a security standard to identify where your organization would like to focus on remediation efforts.

For more information:



Mitigations

  • Sometimes a flaw found by our scanners does not need to be addressed directly via remediation. Maybe you have firewall protection that properly mitigates the risk of a certain vulnerability being exploited, or the flaw is simply a false positive. Whatever the case, this is when you will apply mitigation in the platform so that the flaw can be removed from your queue of flaws waiting to be fixed. 
  • An important aspect to call out about this process is the role of the Mitigation Approver. The Mitigation Approver is a User Role applied on a per account basis. The Mitigation Approver needs to accept, reject, or request more information anytime a flaw is sent to mitigation. To ensure the integrity of your AppSec program, it’s important that the reviewer be someone else besides whoever proposed the mitigation, who also has the expertise to properly review the proposal. Accepting mitigations is essentially accepting uncovered risk, so it’s important that the person reviewing these proposals can properly determine if the proposed mitigation is acceptable or not. 
  • Read here for more info around mitigations. 


Consultation Calls

  • If purchased, encourage your developers to leverage this incredibly valuable resource anytime they get stuck in the remediation process. Our Application Security Consultants (ASCs for short), have helped thousands of customers figure out how to properly package their code base for our scanner, how to remediate specific flaws/vulnerabilities, and review proposed mitigations.  
  • For more info about scheduling a consultation call, see here.
  • For more info on developing a remediation plan, see here. 


5

Review Analytics Regularly


The most successful AppSec programs start with clear goals. The dashboards in Veracode Analytics allow you to track progress against your goals and make data-driven decisions as you develop, grow, and mature your program. Set a regular cadence to review analytics or get in the habit of checking each time you log into the Veracode Platform. With numerous pre-built dashboards and the ability to create your own custom looks, you’ll be able to uncover exactly how your AppSec program has been progressing.  


Reference this guide to get started with analytics, or check out what members share are measuring and where they begin with. 


Better yet, reach out to your Veracode Security Program Manager for help digging into this useful data and customizing your dashboards.

6

Integrate, Integrate, Integrate


I’m sure this won’t be news to anyone reading about this topic, but change can be tough! With that in mind, reducing the learning curve required to get started with security tools is key. Veracode is focused on ensuring developers can remain productive while coding securely. By integrating our solution with developers’ current toolsets wherever possible, developers can continue to work in their familiar environments instead of needing to learn completely new UI’s and systems. 


Check out our detailed integrations document, and/or Integrations Hub pages to get these going. You can also reach out to our support team for further assistance setting up these integrations. 


The most common integrations we suggest implementing fit into a few broad categories that serve different goals:


  • IDE - Best for allowing developers to kick-off manual scans and review results right from where they will be doing the actual remediation. 
  • Build/Pipeline - Best for facilitating automated scans that are kicked off on a regular basis, whether that be time-based (Ex: EOD every Friday), or based on when builds are generated/completed. 
  • Bug Tracking/Ticketing - Best for aiding with remediation prioritization efforts by allowing you to see remediation tasks alongside the other feature/bug fixing work on each team or developer's plate.  


Note: we have extensive APIs for custom integrations as well.