Why software 'security debt' is becoming a serious problem for developers
1–10 of 28 posts
Re: Why software 'security debt' is becoming a serious problem for developers
#2This is marketing for Veracode which is crap by the way.
You can’t assess for risk without knowing anything about the environment, compensating controls and business logic.
Veracode is a check-the-box enterprise compliance tool that reduces engineering productivity and corporate profitability.
Yes, vulnerability management is an important problem but Veracode is not the solution not even close.
Re: Why software 'security debt' is becoming a serious problem for developers
#3Automated detection of risky code can be very useful, but it inherently lacks the capacity to differentiate whether a particular case of bad practice actually is a flaw or not. For a simplified example, usage of eval() in many dynamic languages is potentially risky and could result in a total takeover of the application, so these tools will generally flag it as 'critical' - even if in that particular case this 'eval' is run on data that can't possibly be affected by any user-controlled input (in that case it was used in a slightly weird design for code generation to save on copypasta) and does not have any security risk.
Anecdotally, when I have done triage on such analysis, perhaps 5-10% of things the tools marked as 'critical' (i.e. potentially critical) were flaws which might have had some actual impact and need to be fixed. So when some vendor says in an article like this "The study found nearly two-thirds (63%) of the applications scanned had flaws in the first-party code", keep that in mind - they're generally treating all detections as real, but it's rarely the case.
But on the other hand, it may well be the case that it's simpler to have a process to just clean up all suspicious places in the code; just as the simplest way to avoid use-after-free errors is to use a garbage-collected language instead of just trying to ensure that every single memory allocation in C is correctly implemented.
Re: Why software 'security debt' is becoming a serious problem for developers
#4This is marketing for Veracode which is crap by the way. You can’t assess for risk without knowing anything about the environment, compensating controls and business logic. Veracode is a check-the-box enterprise compliance tool that reduces engineering productivity and corporate profitability. Yes, vulnerability management is an important problem but Veracode is not the solution not even close.
My org almost bought Veracode for $1mil/yr. I'm happy they backed out last minute cause it looked like shit.
Re: Why software 'security debt' is becoming a serious problem for developers
#5When I stared in professional software there was almost an extreme paranoia of adding new libraries. Now we have 20 year olds adding whatever they want via NPM.
Re: Why software 'security debt' is becoming a serious problem for developers
#6This is marketing for Veracode which is crap by the way. You can’t assess for risk without knowing anything about the environment, compensating controls and business logic. Veracode is a check-the-box enterprise compliance tool that reduces engineering productivity and corporate profitability. Yes, vulnerability management is an important problem but Veracode is not the solution not even close.
Are there any good enterprise check-the-box compliance tools? Because having good security doesn't obviate needing to box-check for our certifications.
Re: Why software 'security debt' is becoming a serious problem for developers
#7This is marketing for Veracode which is crap by the way. You can’t assess for risk without knowing anything about the environment, compensating controls and business logic. Veracode is a check-the-box enterprise compliance tool that reduces engineering productivity and corporate profitability. Yes, vulnerability management is an important problem but Veracode is not the solution not even close.
My org almost bought Veracode for $1mil/yr. I'm happy they backed out last minute cause it looked like shit.
I have used Veracode. Its SCA scan picks up fewer CVEs than whatever open-source tool the GitlabCI uses.
Re: Why software 'security debt' is becoming a serious problem for developers
#8Odds are against security. While it is natural to want to automate, programs have a hard time understanding and reasoning about other programs.
Re: Why software 'security debt' is becoming a serious problem for developers
#9Automated detection of risky code can be very useful, but it inherently lacks the capacity to differentiate whether a particular case of bad practice actually is a flaw or not. For a simplified example, usage of eval() in many dynamic languages is potentially risky and could result in a total takeover of the application, so these tools will generally flag it as 'critical' - even if in that particular case this 'eval'…
Yes, this. See also https://overreacted.io/npm-audit-broken-by-design/
Re: Why software 'security debt' is becoming a serious problem for developers
#10Automated detection of risky code can be very useful, but it inherently lacks the capacity to differentiate whether a particular case of bad practice actually is a flaw or not. For a simplified example, usage of eval() in many dynamic languages is potentially risky and could result in a total takeover of the application, so these tools will generally flag it as 'critical' - even if in that particular case this 'eval'…
Veracode is a compliance solution, not a security solution.
You buy it to have it as an insurance when your software gets hacked due to poor software engineering and you leak identities of millions of people. You can claim that “we had a process in place for secure software development” no matter if the tool does something useful or not. CISO and CEO do not get fired, users cannot sure, life goes on.
To use such compliance solution may be also top-down requirement like in the case of SolarWinds after they caused the hacking of the half of the US government: https://investors.solarwinds.com/news/news-details/2023/Sola...