Rising Challenges in Application Security – Aviv Mussinger, Kodem

This is Textron tv. Hey guys, thanks to the throw. We're here with Aviv Muer, who is CEO for Coum.

And we're talking about, well, the challenges that we're seeing with securing applications as we add more and more architectures. And we're trying to develop things faster than ever. And it seems like maybe we're just getting ahead of ourselves, or as we say sometimes in all the skiing advocates, we're just over our skis.

We'll see where we are. Aviv, welcome to shop. Thank you.

Thank you, Mike. Thank you for inviting me. Are we developing software too fast these days or do we, and do we need to slow down or is, um, they used to say back in the day, um, you know, are we running it unsafe at any speed and we're just kind of not able to keep pace?

Or do we need to just rethink how we build software to make it more secure at scale? So I think that we develop software quick, right? Like we, we, we we're trying to improve our pace.

We try to run faster, we try to deliver more, uh, in shorter, in in shorter time. And there's always risk about that. Um, we leverage different things that help us to scale, like open source, right?

Like someone solved this problem before, so let's use that, let's leverage that. And sometimes we forget about the risk that those things can, uh, can create. And, and it's not that we even forget, but, but risks happen and we see and we hear about supply chain attacks, about open source risks and, and, and more and more attacks that happen and, and in a more frequent way.

And, and we should be aware that as we use more components, more third party components, uh, the risks also scale with that. Are the bad guys getting smarter about how to inject malware into those components that we're using out there? And is that part of the issue is we are just not applying enough, um, circumspection to the components that we're using?

'cause we're downloading them off of wherever we think it's handy. So I don't think, I think that everyone gets smarter, right? Like also, like the people that create defending solution gets smarter.

Uh, attackers gets smarter, everyone gets more and more smarter and, and and much more sophisticated than before. But I think that the focus changes, like when, when an attacker thinks about like how to break into something. So if for example, they see that now the door is protected, they will look for the open window, right?

And if they are hundreds of windows, they will find one that you forgot open. So attack surface always changes. Attackers become more and more sophisticated.

Also, the defensive side, like it gets more sophisticated and it's, you know, like, like a mouse and cat game eventually. We've been talking about DevSecOps for a while and we wanna push some stuff further left towards developers, but not all those folks have enough cybersecurity expertise to actually do something meaningful about all this. So what is your advice to folks?

I mean, what is the best way to think about this? How should we restructure the way the software supply chain is constructed? So I think that shifting left, right, and we heard about the shift left paradigm shift left is, is right, like something that must happen.

Like we want security to happen as early as possible. We want developers to be able also and own security, but we need to understand that we can't just throw to the left the problem, but we need to provide the right tools, the right, um, like make the problem feasible also for developers to solve it and not just throw everything so they are like overwhelmed with the amount of alerts. The problem with shifting left is that we were preaching the shift left paradigm and developed many solutions to shift left developers became very overwhelmed.

DevSecOps, everyone became very overwhelmed. But, but, but the by the amount of alerts, the amount of noise, the amount of false positives, the alerts that are not actionable and on every alert, the ability, right? Like 90% of the alerts that today, any kind of an organization faces are just false positives, right?

And, and when you find this like 10% and you focus on the things that actually matter to be able to understand who is the owner, how to fix that, what's the impact of the fix? Everything. Like, it's, it's a long way until, until, until something is remediated.

So this problem led us that developers rather than taking the ownership on security, they're unable to improve, like, to develop business logic now because they need to take care of security all the time. And, and what we see is that we shifted left, but developers like through it all the way, right? And now it's not, the developers are like, are able to even handle this amount of alerts.

But now AppSec practitioners, rather than being like the architects of the security of the application, they are now busy with manual triaging for developers because it's too noisy. And, and eventually it's a lose lose situation. Like everyone loses in this phase.

In, in, in this, in, in this stage. And this is what we see today. This is why we hear from our customers, like, this is the problem that we come to, to, to improve.

This is what we hear from, from CISOs of smaller companies, of small companies and of, of like the largest enterprises of the world. It is something that everyone shared a problem that everyone feels. And when you ask people like how do they feel about their AppSec posture, everyone feels that it could be much more improved, right?

They say like, security is hard, but application security is much, much harder. Do you think someday that maybe AI will save us from ourselves here because we could streamline the number of alerts seems to be a reasonable thing to do in the first place? Exactly.

A AI already helps, right? And it's not, uh, like since, uh, like we all heard about JGPT, that AI like became a, a, like a strong engine that powers security, but, but it's something that, um, was used and, and now it's even like more in use. But definitely ai, we see that with many, many like static analyzer solutions.

I think that there is a, is a huge game changer. But I believe that like what is missing today, and this is something that eventually also powers like AI engines to be more accurate, um, is the ability to understand the actual application context. So think about right, uh, that you are securing something, but when you are like only on the left side, you'll focus on guessing what is going to happen with the application, what kind of flows will be executed, what kind of data will be used, what kind of like different services, like who will communicate with who, right?

And, and this is what is missing. So even if you now like shed some AI on your static analyzer today, you're still missing what is actually happening in the application. You are missing the context.

But when you look at it like the opposite way and you start with the context, you see what happens, what is being executed, how it is being in use, what interacts with who, what, and then you empower that with AI and take, right, like all the knowledge in the world of security, right? And put that into an engine. Then you have like a huge differentiator.

You have like a new kind, a new generation of tools. And like when I, when I, for example, like look at like 2024, those are the kind of tools that we'll see and those are the things that we expect to see more. Those things will replace the traditional approach that we see.

Those solutions will be able to actually create consolidation with application security, which today is fragmented, siloed, and right. It's a huge mess. Do you think cybersecurity people understand the application development process?

And I asked the question because it seems like they just discover vulnerabilities and they throw 'em over the wall and they don't realize that a lot of that stuff may not even be internet facing. It may not, uh, actually have been included in the production environment in the first place and developers wind up chasing their tail and they only have so much time to devote to this stuff. So, you know, are we kinda, uh, wasting each other's time too much?

So, uh, I don't think that AppSec like don't understand about like anything about like, about like software development, but like the ratio is not in favor of, of the AppSec people, right? Like the, I think that the, the latest ratio I heard is like one AppSec for every like a hundred to 150 developers, right? Like every engineer, they have like a whole world of, of knowledge in like the area that they're focused on that they know incredibly well.

It is impossible for an AppSec engineer to know better than like a hundred, 150 engineers, right? And be like, as good as they are in what they do, like, it's, it's not a fair game. And I think that when it comes to being able eventually and, and triage security risks, like the problems that AppSec, uh, that AppSec practitioners are facing is that like they need the developers in order to understand what is the impact in order to understand.

Like whenever you write every new open source vulnerability that comes out and right now there's like, you see what the incident that like an upec manager needs to manage. They don't know anything about, about, about that. Like they, they, they have some knowledge, but even the knowledge that they have, like it already changed because the app, like, like, right, like the, the, the app changes like every, every few minutes, like the higher performance of, of the world, right?

Like deploy like every minute, like the deployable changes and, and it's impossible for, for security teams to keep pace with, with the rapid development. And this is why, and, and, and, and this is why like, as I said before, be like having a continuous solution that monitors your one time, that monitors your application, that provides you the context building blocks to, so you can take decision rather than like chasing, chasing the changes, chasing the developers. Like having another meeting, like this is like not the best usage of time.

What's your best advice to these folks then? I mean, is it a tooling issue or is it a cultural issue? Do I need to put these people in a room and lock the door and make them come up with workflows that make sense?

Or is it just a matter of getting them the right tools and then people will naturally do the right thing? So I think it, it, it's a great question, right? I i I think eventually it's a mix of everything because like a tool, the right tool leads you to a better process will lead you to, will lead you like to a better, uh, like outcomes which help you like improve the way that you use the tool and improve the tool, right?

Or even like find a, like a better tool because like we, like we progress and we evolve like from day to day. Um, so I think that like at the moment I think that there is, there is the ability and the option to, to change like really like revolutionize the way that application security looks today, right? And it's, it's, it's a matter of tool, it's a matter of, of changing the approach that, uh, that we have.

Um, and it'll lead to like a positive feedback loop that we'll see that will improve dramatically the like overall posture of application security and the risk that I, that companies have today. And I think that the best thing that we'll see, like when, when like more companies will like migrate to this new generation of app sectors that we see is that zero day incidents like lock four shell and like, like lib wey and those, uh, things that we hear about, right? Like every month there's a new zero day incident that we, and for the app sector teams, like every day there's a new in every day there's a new incident.

We, we will see that remediation will be much, much shorter. Like the time to remediation will be dramatically shorter because the right tools will be used that can really, uh, handle the, the, the massive amount of third parties and open sources that we use today. Mm-Hmm.

Is there one little thing that you see people doing that you just shake your head a little bit and go, folks, we can be better than that and it would make a huge difference? Uh, I think that when it comes to like, I think that every aspect of AppSec is something that people really, really want to be better at. I think that in open source security, because remediation is sometimes very, like, might be just patching a library, right?

And it, it is just a matter of patch. Like nothing breaks and, and it's so easy. Sometimes it's, it's frustrating that you have so many things on your table and it is, IM, and, and the fix sometimes is so easy, but it is just like finding the right thing to fix, being able to focus on the things that actually matter.

All right folks, well, you heard it here. There's plenty of bad guys out there, but you can't help but wonder if maybe just maybe, you know, our worst enemy is ourselves and we just need to sit down and think this through a little bit. Aviv, thanks for being on the show.

Thank you very much for inviting me. All right. And back to you guys in the studio.