The combination of increasingly sophisticated cyber threats and the growing complexity of software applications demands that organizations evolve their approach to cybersecurity.
Today’s cloud-native applications are composed of loosely coupled microservices and application program interfaces, which can make identifying anomalies a difficult and sometimes daunting task. Services may be spread across multiple cloud and on-premises servers and the growing use of software-as-a-service and remote access by home-based workers adds to the complexity.
Observability is the powerful ally needed to enhance security defenses by providing deep insights into system behavior that empowers security teams to detect, mitigate, and respond swiftly to potential threats.
Real-time insights
Observability provides real-time visibility into an organization’s digital infrastructure, giving security teams additional context to security incidents and to help incident responders and threat hunters stop threats and accelerate response.
Traditional cybersecurity measures like penetration testing, static analysis, and vulnerability scanning each have great value but they focus primarily on static defense mechanisms. Observability, in contrast, collects and analyzes vast amounts of real-time data. Observability tools give security experts immediate insight into anomalies, unusual patterns, and potential threats, enabling them to detect and address issues early before they escalate.
Observability equips organizations to aggregate and analyze data from diverse sources. By correlating seemingly disparate pieces of information, the tools help security teams gain a more comprehensive view of potential threats.
The tools can be used both proactively and reactively. Proactive monitoring continually scans applications and infrastructure to detect changes that may indicate that an attack is underway. Machine learning enhances human analysts by establishing baselines of normal system behavior so that anomalies can be more easily detected.
For example, it is common for a large number of users to login in the morning hours but uncommon for them to do so late at night. A machine learning-powered observability solution can identify atypical login activity and can generate an alert to the security team. After an incident has been detected and (hopefully) resolved, observability data can be used for post-incident forensics to help identify attack vectors and assess any damages.
Observability components
There are four basic components of security-first observability: Events, logs, metrics, and traces.
- Events are significant incidents that affect performance or indicate unusual behavior. They frequently aggregate information from logs, metrics, and traces to give security teams a high-level view of anomalies such as unusual user actions or system state changes.
- Logs are a granular record of specific events and activities that occur within a system. They document the details of a sequence of actions to enable security teams to understand events at a fine-grained level. Examples include details of a user’s attempt to connect to a server and records of internal server errors.
- Metrics are quantitative measurements of a system’s performance and behavior over time. Examples include CPU usage, memory consumption, response times, and request rates. Security teams can use them to look for patterns that are common to certain types of attacks. For example, form submissions that repeatedly include commands like UPDATE, DELETE, INSERT, or TRUNCATE may indicate an attempted SQL injection attack.
- Traces are records of connected events over time. Distributed tracing allows transactions and requests to be monitored as they flow through different components of a system. Security teams can use these records to backtrack through a series of events to identify the root cause, such as a login by a specific user at a particular time.
Software built with security in mind
The best way to avoid a problem, of course, is to minimize the risk that it will occur in the first place. That’s why interactive application security testing (IAST) should be part of every software development team’s toolkit.
IAST works during the development process to provide immediate feedback on vulnerabilities so they can be addressed proactively during the coding and testing stages. Applications are instrumented with security sensors or agents that monitor and analyze their behavior as they run. The agents intercept interactions and transactions to look for potential security flaws.
Alongside IAST, organizations also need to incorporate vulnerability management technology to help solve security challenges. The industry, more broadly, requires both vulnerability management and IAST for organizations looking to take a more extensive approach to securing their data, improving the customer experience, saving time and money on manual resources and eliminating risk before it impacts their bottom line. Plus, by incorporating vulnerability management, teams can avoid silos and elevate security problems at the AppSec level.
Unlike security analysis tools that rely on external interactions with the application, IAST can pinpoint the exact lines of code that are associated with security vulnerabilities. The technique also adapts to an application’s dynamic behavior to help in identifying security issues that may only surface during certain runtime conditions. IAST tends to generate fewer false positives since analysis is only applied at runtime and it is flexible enough to be used for both web and non-web applications.
Like all security measures, IAST isn’t a one-size-fits-all solution. It’s best used in concert with other testing methods like static application security testing, dynamic application security testing, and manual penetration testing to achieve the most robust security posture. The efficacy of IAST also depends on the quality and accuracy of the security sensors or agents used in the testing process.
To equip dev, ops and security teams with the right tools, it’s critical to understand how these solutions solve industry-wide challenges and deliver the capabilities needed to help teams minimize false positives, prioritize high-risk vulnerabilities, and find and fix vulnerabilities with proof-of-exploit. Organizations should ask prospective observability suppliers about their security capabilities, like vulnerability management and IAST, to ensure that they have the most robust set of proactive and reactive tools possible, so teams can focus on real security risks and not false positives.
##
ABOUT THE AUTHOR
David Puzas is the senior director of product marketing for cloud security and platform at New Relic. Prior to New Relic, he led product marketing efforts for security at companies such as Crowdstrike, IBM, Dell SecureWorks, BlueCat, and others. With 20+ years of experience, David is a proven cloud and cybersecurity marketer focused on helping organizations optimize computing innovation, trends, and their business implications for market expansion and growth.
