Move Security and Pen Testing Left

Penetration Testing

The oft-preferred environment for penetration testing is the production environment. Organizations would prefer pen testing performed when the applications and network are more stable, i.e., tested and validated as production-ready.

Penetration (or pen for short) testing or ethical hacking simulates a possible cyberattack on the system. It follows a plan that starts with a survey (reconnaissance) of the system topology, which includes the network, applications, and databases for vulnerabilities—next, a network mapping tool runs to scan for open ports and firewalls.

Once the system vulnerabilities assessment completes, pen testing can proceed to exploitation, where the tester exploits the system simulating what could happen in actual attacks. During the exploitation, the tester takes care not to cause damage to other systems in the production environment.

The benefit of using the production environment is that the results will be accurate. The test results will manifest the actual vulnerabilities of the infrastructure and applications. Also, any violations that are identified will be in real-time.

The drawback of pen testing in production:

1. The pen testing can interfere with operations causing system outages.
2. In many instances, penetration testing is performed a few weeks before production cutover. Security breaches and vulnerabilities identified during the testing may require more time to remediate before deploying codes to production. Raising security risks and recording a plan to fix the problem at a specific date doesn't guarantee that the vulnerabilities will be addressed on time and with the right resources. A cyberattack can occur before the problem is fixed.

Will pen testing in a non-production environment mitigate the problem?

There is better opportunity for testing not to be rushed when performing pen testing in a non-production environment because

1. The team will not have to worry about interference with operations.
2. Pen testing can be performed in parallel with other non-functional testing, such as performance and volume testing.
3. Business will be informed of the identified vulnerabilities so that weaknesses are addressed and applied in production before the cutover date.

For this to work, however, the non-production environment must closely resemble the production environment. It will have the same network and firewall configuration, automated workflow orchestration, and connection to production databases.

Penetration testing must include penetrating network services, databases, web applications, mobile applications, and APIs. Use cases to have brute force attacks and social engineering attacks.

Security Testing

Moving security testing left means testing for application security at the early stages of the development lifecycle. This testing method entails close collaboration between the development, security, and operations teams.

The principle behind security testing left is to detect security vulnerabilities early so that they can be fixed with less impact on cost and delivery date. It is a project management approach that integrates security, development, and operations processes.

How this will work:

1. The information security team will provide input to the technical design, test plans, and test cases.
2. Developers must closely work with the security and testing teams throughout the software development lifecycle.
3. The security review will be a gating factor to releasing the design to the development stage.
4. All levels and stages of testing must include test cases that validate that the solution satisfies the security requirements.
5. The security and operations review will be a gating factor in releasing the codes to production.
6. Develop automated security testing to facilitate integrating (continuous integration) evolving security tests and approaches.

This approach reinforces security in planning, building, testing, and deployment to deliver secure software.

The benefits of having a collaborative DevSecOps culture:

• Developers and the security team share the security responsibility.
• Developers and testers understand security issues and apply security best practices.
• The DevSecOps team delivers better and more secure codes, and they help minimize workflow bottlenecks.
• Security vulnerabilities are detected during the development phase rather than during the implementation or testing phase. Remediation is performed as part of the build workflow.
• Security detection is planned and monitored.
• Multiple testing and more extensive test coverage mean errors are identified before codes are deployed to production.
• Application security testing builds a defense against potential attacks. By the time the codes reach the environment where penetration testing is performed, application vulnerabilities sighted will be minimal.

Mitigating DevSecOps Challenges