12 Steps to Secure Software

Awareness is the foundational step in any cybersecurity strategy, crucial for understanding the importance of security measures and fostering a culture of vigilance. By recognizing the potential risks and the impact of security breaches, organizations can prioritize and commit to comprehensive security practices.

NIST mandates the implementation of security awareness and training programs as part of its comprehensive cybersecurity guidelines, ensuring that all personnel are educated about their roles in safeguarding information systems. For more details, refer to NIST Special Publication 800-50.

Cultivate awareness through regular training sessions, engaging seminars, and updated security briefings that keep all employees informed about the latest security threats and best practices. Additionally, utilize internal newsletters, security awareness posters, and e-learning modules to ensure that security remains a visible and ongoing priority throughout the organization.

Incorporate Live Hacking Events as powerful eye-openers to demonstrate real-world vulnerabilities and the ease with which breaches can occur.

Cloud environments often automate the patching of hosted services and infrastructure, significantly easing this aspect of security management. However, for custom applications and third-party dependencies, the responsibility usually falls on the cloud customer to ensure they are regularly updated, leveraging tools provided by the cloud platform for automation where possible:

• For AWS, consider to build an end-to-end AWS DevSecOps CI/CD pipeline which also covers dependency checking.
• For Azure, GitHub Advanced Security for Azure DevOps also covers dependency checking.

Utilize the cloud provider’s best practices like setting up security groups, network access controls, and ensuring that default configurations are changed to secure settings. Automation and template-based deployments can help maintain consistency across environments. Where possible, leverage cloud-native security tools to monitor and enforce security configurations:

• For AWS, consider using cfn-nag, cdk-nag, Checkov, TFLint and others to scan Infrastructure-as-Code (IaC) definitions. Also execute the CIS Benchmarks scans within the cloud to ensure secure configurations. Using AWS Inspector can also help to assess the security and compliance of the applications running on AWS.
• For Azure, consider using the Microsoft Security DevOps extension to scan Infrastructure-as-Code (IaC) definitions. Also execute the CIS Benchmarks scans within the cloud to ensure secure configurations.

Static Code Analysis can be performed using commercial tools or a blend of the following open-source tools, depending on your programming language:

• Find Security Bugs (Java, Groovy, Scala, Kotlin)
• Security Code Scan (.NET)
• GoSec (Go)
• Brakeman (Ruby)
• Bandit (Python)
• NodeJsScan (Node.js)
• PHP CS Security Audit (PHP)
• SonarQube / SonarCloud
• Semgrep

Cloud-based tools can be configured to scan source code during the build process, providing real-time feedback to developers on security issues, for example:

• For AWS, integrating SonarCloud with AWS CodePipeline can create a comprehensive end-to-end AWS DevSecOps CI/CD pipeline.
• For Azure, integrating the Microsoft Security DevOps extension and Microsoft Security Code Analysis or GitHub Advanced Security for Azure DevOps is beneficial.

Use cloud-based development environments that enforce these practices and offer real-time feedback to developers on security issues. Seize the resources provided by cloud platforms to educate developers on secure coding practices and ensure compliance with security standards:

• For AWS, explore the AWS Well-Architected Framework, particularly the Security Pillar, which provides best practices and strategies to help you secure your workloads.
• For Azure, Microsoft’s Secure Development Best Practices on Azure offer a series of articles detailing security activities and controls for cloud application development.

Training developers on security best practices (referencing the secure coding requirements) complements the previous step by reinforcing the importance of security and empowering developers to write secure code.

NIST mandates the implementation of security awareness and training programs as part of its comprehensive cybersecurity guidelines, ensuring that all personnel are educated about their roles in safeguarding information systems. For more details, refer to NIST Special Publication 800-50.

Leverage online platforms and cloud provider resources for up-to-date security training tailored to cloud development. Encourage participation in cloud-specific security training programs and certifications to build awareness and expertise:

• For AWS, explore the AWS Training and Certification for Security, which offers various resources to help developers understand security best practices, including secure coding for cloud environments.
• For Azure, Trust Center provides a comprehensive guide on developer security best practices.

Conduct security assessments using cloud-native tools or third-party solutions integrated with the cloud environment:

• For AWS, the AWS Security Hub provides a comprehensive view of your security state within AWS environments and can automate checks against security industry standards.
• For Azure, the Azure Security Center offers a unified infrastructure security management system that strengthens the security posture.

Use threat modeling tools with cloud-specific templates to assess risks and design mitigations. Ingest cloud-specific tool suggestions from the cloud provider’s security resources:

• For AWS, the AWS Well-Architected Tool can help you review your workloads against AWS best practices and identify potential security risks.
• For Azure, the Microsoft Threat Modeling Tool provides threat modeling capabilities to help you identify and mitigate security risks in your Azure environment.

Penetration testing to uncover vulnerabilities not prevented or detected earlier comes in various forms:

• Black Box with no prior knowledge,
• Grey Box with some knowledge about the architecture and tech stack, and
• White Box with full knowledge usually including source code access.

For structured methodologies, refer to the OWASP Testing Guide for comprehensive insights. Also, it’s important to establish a feedback loop from the findings to understand the root causes and adjust internal practices accordingly, preventing future regressions.

Use approved methods and tools to test the security of cloud-hosted applications and infrastructure from an external perspective, identifying vulnerabilities that could be exploited by attackers. Coordinate with cloud providers to comply with their penetration testing policies and procedures:

• For AWS, refer to AWS Penetration Testing.
• For Azure, refer to Azure Penetration Testing.

Enhance your application’s security by elevating Authentication and Authorization mechanisms. Implement Multi-Factor Authentication (MFA), enforce strong password policies, and apply the principle of Least Privilege across all access points. Utilize trusted authentication providers and protocols to ensure robust security. In Microservice architectures, adopt a Zero Trust approach by propagating tokens inside the backend (using a Service Mesh might help here), thereby decentralizing authorization and making it harder for attackers to move laterally within the system.

This strategy integrates advanced security practices into your application’s authentication and authorization layers, significantly reducing the likelihood of unauthorized access and enhancing overall security posture.

Implement cloud-native identity and access management (IAM) services to manage user identities, permissions, and access controls. Utilize multi-factor authentication, role-based access control, and least privilege principles to secure access to cloud resources:

• For AWS, AWS IAM allows you to set up and manage permissions in a granular manner. For enabling MFA for end users in AWS, refer to the Amazon Cognito documentation.
• For Azure, Entra AD offers comprehensive identity and access management, both in the cloud and on-premises. For enabling MFA for end users in AWS, refer to the Entra AD B2C documentation.

Encrypting sensitive data is crucial not only for ensuring privacy and security but also for complying with data protection regulations like GDPR and CCPA. Following the principles of privacy-by-design, encryption should be integrated after secure authentication and authorization frameworks are established to provide a comprehensive security posture.

As Amazon CTO Werner Vogels famously said: “Dance like nobody’s watching, encrypt like everyone is.” This emphasizes the need to assume that external scrutiny is constant, underscoring the importance of rigorous data protection practices.

Implement encryption effectively by distinguishing between in-transit and at-rest requirements:

• For in-transit data, secure all forms of communication, not just HTTPS traffic, by implementing protocols like TLS for JDBC and other messaging protocols.
• For data at-rest, focus on employing strong encryption standards and robust key management practices. This involves not only choosing the right encryption algorithms but also ensuring the secure generation, storage, and handling of encryption keys to prevent unauthorized access.

Employ cloud services for data encryption, both at rest and in transit, using the cloud provider’s built-in encryption capabilities. Ensure proper key management practices, possibly using the cloud provider’s key management service, to secure encryption keys.

• For AWS, encrypting sensitive data using AWS Key Management Service (KMS). Regarding data protection regulations, refer to AWS Artifact.
• For Azure, using Azure Key Vault for managing and encrypting keys and secrets. Regarding data protection regulations, refer to the Service Trust Portal.

Implement a Security Information and Event Management (SIEM) system to gain real-time insights into your application’s security posture. Additionally, integrating OSSEC can enhance host-based intrusion detection by monitoring parameters such as log files, file integrity, and rootkit detection. This allows for swift detection and response to threats. Utilize open-source tools like ELK Stack (Elasticsearch, Logstash, Kibana) for logging and monitoring.

Develop a robust Incident Response Plan to effectively manage and mitigate the impacts of security incidents, ensuring continuity and maintaining trust. Refer to the NIST Incident Response Guide for structured approaches. Remember to include post-mortem root-cause analysis to learn from incidents and improve security practices as a feedback loop to the aforementioned steps.

Develop an incident response plan that leverages cloud services for rapid response and recovery, and ensure it’s regularly tested and updated. Adopt cloud-based SIEM solutions that offer integrated logging, monitoring, and real-time analysis of security alerts:

• For AWS, refer to AWS Security Hub as well as AWS GuardDuty for intelligent threat detection.
• For Azure, Azure Sentinel provides extensive SIEM capabilities, offering integrated threat intelligence, real-time analysis, and rapid response.

Implement metrics that highlight areas needing attention and track improvements over time. Dashboards should be utilized to make security metrics visible to project managers, emphasizing the importance of security within project KPIs. Tools like OWASP Defect Dojo can be used for tracking lower-level security issues, but it’s crucial to also aggregate these findings into higher-level metrics that can be visualized and monitored in broader management tools. This approach not only highlights vulnerabilities but also supports proactive security management by making (in)security a visible and quantifiable aspect of project performance.

It’s crucial to develop KPIs from security metrics (such as findings from SCA, SAST, DAST, Penetration Tests, and Threat Modeling) that incorporate the time factor to monitor improvements or persistence of vulnerabilities over time. Metrics like the Average Time of Exposure of high-risk findings in production environments are especially valuable, as they provide clear indicators of how quickly security issues are being addressed and resolved.

Use cloud monitoring and management tools to track security metrics and KPIs. These should include measures of compliance with security policies, incident response times, effectiveness of security controls, and user access and activity monitoring:

• For AWS, CloudWatch provides detailed monitoring and analytics.
• For Azure, Azure Monitor is key for tracking security metrics and KPIs.