#1 Intro
The new requirements from NIST
Last fall, the US National Institute of Standards and Technology (NIST) updated its security and privacy framework, Security and Privacy Controls for Information Systems and Organizations (SP 800-53.2). In doing so, it has recognized the inefficiency of current application security methodology and the need for a paradigm shift if we were to step up security of applications running in the cloud.
The final version of the NIST privacy framework, released on 23 September 2020, introduced two important new requirements in the area of application security (AppSec).
The recommendations call for broader adoption by development teams of runtime application self-protection (RASP) and interactive application security testing (IAST) solutions.
The inclusion of IAST right at the software development phase will help developers catch security flaws and vulnerabilities before the launch of an application. While the addition of RASP will ensure advanced security during runtime and prevent sensitive data loss by organizations.
And the time is more than ripe for a stepped-up defense against digital threats.
#2 Significance of the new requirements
The reality of AppSec today
The year 2020 brought big changes to how business is done. The COVID-19 pandemic spearheaded the now widespread phenomenon of working from home. With it, brought the digital transformation of organizational architecture. In simple words, businesses moved their data and applications to the cloud.
Suddenly, cybercriminals have a much wider field for their malicious activity. Every day we see increasing numbers of attacks on web applications and zero-day exploits on applications still in development.
The recent 2020 Data Breach Investigations Report by Verizon revealed attacks on web applications accounted for 43% of all breaches ”double the previous year’s total.
While a new Ermetic survey showed nearly 80% of organizations have had a cloud data breach during the analyzed period.
This brings home one point: There is no such thing as a safe organization, anyone is a target.
The 2020 Mandiant Security Effectiveness Report found that only 26% of attacks are detected with the majority successfully bypassing organizations‘ security.
Clearly, AppSec solutions in use today are not working.
It is in recognition of this failure of today’s security technologies that NIST released Revision 5 of its SP 800-53 framework.
Agile and DevOps need a different AppSec approach
Typically, the security infrastructure of virtually any organization consists of a web application firewall (WAF) and some anti-malware/virus solutions. While these security layers do protect against certain types of attacks, they lack the visibility to protect against the more sophisticated attacks we increasingly face today.
Another third layer is needed the application security layer. Without it, data and applications are left vulnerable.
The new requirements for RASP and IAST in the NIST security and privacy framework recognize the need for this third level for AppSec.
Agile and DevOps, the two prevailing development methodologies, simply move too fast for traditional outside-in AppSec solutions. An overwhelming number of false positives eat valuable dev time, while false negatives turn risks into threats.
Since Agile and DevOps are measured in terms of product-to-market velocity, they must keep up with the pace of the digital business. The reality is, traditional AppSec approaches often create development delays and setbacks. Partly because they require a significant expert workforce and create a lot of false positives.
The new NIST requirements are proof that today’s AppSec methodologies are antiquated and ineffective.
A complete paradigm shift is necessary. AppSec must start on the inside of the software. This will provide continuous, proactive, and real-time protection.
#3 A closer look at RASP and IAST, and how they are different
What is RAST?
Runtime Application Self-Protection, first introduced in 2012 and gaining attention only in 2014, involves AppSec solutions that run directly on an application server and provide continuous protection for the applications on that server. Because of this, a RASP solution has visibility into the operation of the protected application that other types of security solutions lack.
Typically, a RASP solution can detect security breaches of several types, including memory-based, zero-day, and real-time attacks. It can deal with the top 10 security threats as rated by the OWASP foundation, including the notorious cross-site scripting (XSS) and SQL injection (SQLi). RASP can block or immediately patch them. In this, RASP is the first security solution to offer self-protection for web applications.
And what is IAST? Active and passive
Interactive Application Security Testing uses a software agent running directly on the application server to observe the application as it is running (whether in development, test, or production environments).
It is similar to the way RASP works, but IAST solutions have the visibility to report further details about the detected vulnerabilities. IAST can directly access code, libraries, user interaction, frameworks, configurations, and back-end connections.
Both IAST and RASP does not give many false positives like traditional testing technologies.
But the main benefit is that IAST can provide early detection of security vulnerabilities, that is before they are exploited by hackers.
Today, there are two categories of IAST solutions, active and passive.
Simplified, active IASTs require two modules: a web scanner to check the application, such as a DAST (also known as inducer or attack component), and the IAST agent (also known as detect component). The IAST agent runs on the application server of the application and provides additional details, such as the location of the vulnerability in the code.
Passive, or full, IASTs do not require the scanner component, because any traffic activates vulnerability analysis by the detection component.
The main difference, though, is that passive IASTs work even when the target application modifies the input data while processing the request ”something that active IASTs cannot handle. For this reason, Gartner, a well-known research organization, specifically recommends passive, full-featured IAST solutions over the active ones.
#4 Implementing new NIST requirements
Deploying IAST is easy and fast. A development team simply adds the IAST agent to the application server (for example, Tomcat or IIS), and the agent starts to monitor all apps hosted on it.
Once deployed, an IAST solution automatically identifies vulnerabilities that developers can fix as they keep writing the code. This is cool because there are no disruptions by security scans.
RASP is also fast to deploy and easy to use. A security or development team simply deploys the RASP agent inside applications running in the production runtime environment. RASP then continuously monitors the application detecting and preventing threats, both known and unknown. A RASP agent also performs other actions like sending a warning message to the user or an alert to the security team.
The NIST requirement does not specify an IAST solution of what category, active or passive, should be implemented, so it is up to organizations to decide.
Speaking of federal government agencies and those working for the federal government, the US Office of Management and Budget (OMB) in its Circular No. A-130 is very clear about the time-frames for complying with the new NIST guidelines. Any systems currently in development must be in compliance when they are released for deployment. And all legacy systems must be in compliance with the standards and guidelines within one year of the publication date, that is by 23 September 2021.
#5 How RASP and IAST can advance organizations’ AppSec
After NIST recognized the need for better application security with its SP 800-53, there is no coming back. Organizations that follow its lead by implementing the new requirements will be a better fit to withstand online threats and will incur lesser losses in 2021 and onward.
By adding IAST, organizations will ensure their applications are thoroughly tested before launch. By adding RASP, they will get an additional layer of security for applications in production and enable self-protection for applications that have vulnerabilities.
The NIST framework is quickly becoming the golden standard in the USA. While the NIST framework is mainly used by federal government agencies, the private sector is not far behind. According to NIST’s own 2020 projection, half of US businesses would have complied with the new guidelines by year-end.
The new standards will certainly have a significant impact across all industries.
