As many organizations are bolstering up their security measures, hackers have shifted their focus to smaller and more concentrated attacks, according to Daniel Fonseca, senior solutions engineer at Kiuwan in the webinar “Preventing common vulnerabilities with Kiuwan’s SAST, SCA, and QA tools.”
The National Vulnerability Database (NVD) said there were over 20,000 security vulnerabilities CVE published in 2021 – a 15% increase from 2020. The top five vulnerabilities that came up in 2021 were broken access control, cryptographic failures, injections, insecure design and security misconfigurations in the OWASP Top 10.
“In order to prevent such vulnerabilities, companies need to shift their priorities and infuse best practices within each organization. For starters, a product roadmap is a high-level summary that visualizes product direction over time, and it’s great for implementing best practices within development,” Fonseca said.
Another great way to tackle these problems is by employing a Static Application Security Testing (SAST) tool or other tools that can identify risks early in the CI pipeline or within the IDE.
As security moves right, coverage becomes increasingly challenging by implementing security earlier in the development cycle with the use of SAST, SCA & QA – it automatically reduces the remediation work that can arise later in the cycle, according to Fonseca. Because half of web application vulnerabilities are critical or high-risk, this raises an important challenge for developers. Time to remediation for vulnerabilities is over 60 days, with significant cost accrued during the remediation process.
Watch this on-demand webinar to find out more about how Kiuwan’s two-part platform can be used to prevent security breaches. Kiuwan is composed of the cloud component, which serves as the web console, and the Local Analyzer, which performs scans and looks for patterns within source code in applications.
“Basically, the reason why we have the Local Analyzer is because we want to make sure that you don’t need to ship or upload the source code of your applications anywhere in the cloud. But that intellectual property is going to remain on your premises, and the local analyzer will run the scans locally and upload only the results to the cloud,” Fonseca said.
