Stop Living in the Past A New Approach to Application Security

## Overview Joseph Amon, Chief Innovation Officer at Veracode, argues that traditional application security approaches fundamentally fail to support modern DevOps practices, which demand multiple releases per day, continuous deployment, rapid feedback, and deep automation. Traditional security operates via intermediaries and conducts testing primarily at the end of the development lifecycle, creating unacceptable delays for DevOps teams. Additionally, peripheral security technologies (firewalls, WAFs, endpoint protection) treat applications as black boxes, lacking visibility into application logic and data flow.

## Key Challenges Identified DevOps requirements include multiple daily releases, rapid cycle times measured in minutes to hours, continuous testing throughout the lifecycle, and collaboration between developers and security teams. Traditional application security creates a gap: developers cannot access security tools directly, requests take days to resolve, and testing happens too late in the cycle. When vulnerabilities are discovered at deployment time, developers must redesign and reprogram, delaying releases significantly.

## Criteria for Modern Application Security Amon identifies four essential criteria: 1. **Transparency**: Security tools must not interfere with developers' primary objectives (functionality, quality, performance) 2. **Incremental approach**: Technology must test smallest code snippets continuously throughout the lifecycle, not just at deployment 3. **Rapid implementation**: Response times measured in seconds to minutes, not days or weeks 4. **Insight**: Deep visibility into application logic and data flow, moving beyond black-box analysis

## Emerging Technologies **Developer SAST and Team SAST**: Modern variations of static application security testing integrated into IDEs and cloud services, enabling developers to test code increments as they write them with turnaround times of seconds to minutes, then progressively tested at build level.

**RASP (Runtime Application Self-Protection)**: An agent seamlessly instrumented into runtime environments (Java Virtual Machine, .NET CLR, PHP engines) that monitors application behavior, distinguishes benign from malicious activity, and stops attacks by preventing malicious instruction execution or sanitizing input. Transparent to developers and operating specialists, always running once installed.

**IAST (Interactive Application Security Testing)**: Uses RASP technology combined with attack inducers (DAST, embedded generators, or Quality Assurance scenarios) during testing phases, providing high accuracy with minimal human involvement and always-running continuous monitoring.

**SCA (Software Composition Analysis)**: Metadata-based repository of millions of third-party components that detects vulnerable open-source components in applications. Amon recommends combining with SAST for complete coverage, as SCA lacks insight into actual code usage patterns.

## Lifecycle Integration Amon demonstrates how these technologies integrate across the complete lifecycle: Developer SAST for individual code increments, Team SAST for build-level testing, System SAST for complete application testing (typically within one hour), SCA for component vulnerability analysis, DAST or IAST for runtime testing, and RASP for production protection.

## Market Predictions (through 2020) Amon projects cloud-based security services will exceed tool-based implementations due to better transparency and scalability; majority of DevOps-adopting enterprises will adopt developer static analysis; SAST will exceed DAST for DevOps use due to DAST's need for excessive crawling and attack generation; approximately 25% of DevOps enterprises will adopt IAST; and more than 40% of enterprises will adopt SCA.

## Recommendations Start adoption with traditional, mature technologies (SAST, DAST, SCA), preferring cloud services over tools for transparency and scalability. Gradually evaluate and adopt emerging technologies (developer SAST, IAST, RASP) in parallel. Apply all technologies at appropriate lifecycle phases rather than replacing existing approaches. Consider shifting IT security spending from network security (currently dominant) toward application security, as network security lacks application-level visibility.