What is waterfall AppSec?

Many web development teams have evolved their workflows from a waterfall-style process to more agile methodologies. Modern software development relies heavily on automation to rapidly get new features into production and fix bugs as quickly as possible. In the most efficient CI/CD (continuous integration/continuous deployment) pipelines, changes are committed and releases deployed many times a day.

Even with this pace of development, application security testing in many organizations is lagging behind and still relies on inefficient manual handoffs. Every time a vulnerability is found, the automated pipeline has to stop and wait until the issue is fixed. This negates the rapid feedback benefits of agile development and creates a time and efficiency gap between security and development.

How waterfall AppSec hurts organizations

Many organizations we talk to know that their AppSec practices are inefficient and need to be modernized. Others have simply given up on trying to catch up with development, convinced that nothing can be done to make security testing more efficient – or that it’s not worth the effort and investment. In these cases, the gap between security and development keeps growing, with serious consequences for application security and the business as a whole:

• Delayed releases: Manual security handoffs create a bottleneck in the automated development pipeline, negating the benefits of fast feedback loops. When vulnerabilities are found, developer tickets are often created and managed manually, which can lead to security issues delaying entire releases.
• Greater risk of breaches: When the security testing process is slow and inefficient, tests might be skipped in the face of release deadlines. Under pressure of time, vulnerability fixes submitted by developers may go into production without retesting, often introducing new vulnerabilities.
• Internal friction: Developers are used to working in their efficient and automated workflows, so manual security tickets break their rhythm and are seen as an annoyance. The security team, in turn, is frustrated by back-and-forth with developers, leading to friction between development and security.
• Slower growth: For many companies, getting new web application features into production is crucial for revenue. When security issues hold back releases, they are also holding back business growth.

Using Invicti to eliminate the bottleneck

Fortunately, more and more development teams are aware of this inefficiency and have started treating vulnerabilities like any other bug. Apart from a change in processes and mindset, this also requires tools that allow teams to integrate security testing into their existing SDLC and provide fast feedback to developers on security issues. Modern dynamic application security testing (DAST) solutions such as Invicti are especially suitable for this because they are easy to deploy and provide broad testing coverage regardless of the underlying architectures and technologies.

When you are sending work to developers automatically, you need accurate results to avoid false alarms and manual interventions. Invicti uses Proof-Based Scanning to automatically confirm and categorize over 94% of direct-impact vulnerabilities – and when a vulnerability is marked as confirmed, you can be 99.98% certain that it is real. This saves security engineers the effort of manually verifying scan results and creating tickets, allowing them to focus on tasks that really need human expertise. 

You can also set up security gates in the CI/CD pipeline so that no vulnerabilities above a specified risk tolerance can make it into staging or production. That way, security standards are automatically enforced with every new release. Whenever vulnerabilities are found, developers get rapid feedback and remediation guidelines, and fixes are automatically retested to make sure the security flaw is gone for good.

Helping organizations on their journey towards DevSecOps

As much as it's an industry buzzword, DevSecOps is also a workflow ideal where software development, operations, and security all work together in an efficient and automated process. At Invicti, we’ve been helping customers build security into their SDLC for many years, working towards DevSecOps before the term even existed.

A typical workflow is to use Invicti’s out-of-the-box integration with mainstream CI/CD platforms such as Jenkins to automatically trigger scans. Invicti then classifies the results and automatically creates developer tickets for actionable vulnerabilities via an issue tracker integration, for example with Jira. Vulnerabilities are confirmed using Proof-Based Scanning, so no false positives are automated into the developers’ workflow. This opens the way to building a hands-off application security testing process. In this fully automated scenario, the security team no longer needs to do any routine vulnerability verification and can focus on security management and investigating more advanced issues.

We’ve helped many organizations to move away from waterfall AppSec and incorporate automated security testing into their SDLC for maximum benefits at their current level of process maturity. With Invicti, it is possible to get quick and measurable security and efficiency improvements in practically any web application development workflow. Whether you’re taking your first steps in adding security testing to your SDLC or want to move to a fully automated DevSecOps workflow, Invicti can help make application security an integral part of your development process.