Building scalable, cost-effective application security
da-kuk/Getty Images
Connecting state and local government leaders
COMMENTARY | Automated scanning and remediation platforms can identify, fix and prevent security gaps and vulnerabilities at the software application and development levels.
Security gaps in websites, web apps and application programming interfaces (API) are multiplying across modern enterprise IT ecosystems that increasingly incorporate app-based components. In the public sector, agencies are concerned about vulnerabilities showing up in government apps ranging from citizen and customer engagement platforms to file sharing, compliance and reporting systems.
The challenge is particularly intense at the state and local level, where agencies often struggle with less reliable funding streams, older infrastructure and limited workforce resources. Fortunately, these public sector organizations are finding better application security (AppSec) protections increasingly within reach. Cost-effective platform approaches for automated scanning and remediation can now bring zero trust and other robust security frameworks to government agencies of any size.
Clarifying AppSec risk in government
AppSec is now mission-critical as public sector agencies operate the kind of app and API-intensive ecosystems that citizens demand. Vulnerabilities in government apps have led to downtime, data loss and delays in project deployment. Such impacts would be worrisome enough for a private-sector company, but they have even larger implications for public-sector agencies working to deliver essential government services for constituents.
Not surprisingly, government agencies are learning to fight back with stronger zero trust measures that replace older, context-based trust models. In crafting their approaches, state and local agencies can leverage publicly available zero trust reference architectures that contain templates on solution, process and interface design. But there’s a big difference between having guidelines to follow and actively implementing a working AppSec solution across a state agency.
Achieving scalable, cost-effective AppSec at every level of government
State and local agencies face strict compliance and citizen service mandates despite dealing with scarce resources and often daunting levels of complexity. Consider the example of a regional public transit agency saddled with securing a sprawling, app-intensive network of critical infrastructure, supply chain and services that might stretch across multiple states. Maintaining a comprehensive and effective AppSec posture across such a system is no easy task.
To square these challenging demands with limited resources, more state and local agencies are opting for zero trust and other AppSec enhancements rendered in proactive, affordable and scalable platforms designed to identify, fix and prevent security gaps and vulnerabilities at the software application and development levels. Such approaches typically involve continuous, automated security scanning that covers every corner of an organization’s application portfolio and provides targeted remediation guidance when a vulnerability is identified.
Given the tight deployment schedules most agencies contend with, such platforms should move the burden onto the technology and off the shoulders of staff as much as possible. Steps to achieve this shift include automating vulnerability scanning wherever possible and adopting “security by design” frameworks to help software development teams integrate security earlier into their existing workflows. This strategy helps head off problems by enhancing security in the early stages of development, as well as in production environments—without infringing on delivery times.
Strategic partnerships to maximize AppSec effectiveness
In pursuing better AppSec solutions, many state and local organizations realize they can’t do it alone, and that’s where partnering is critical. The right AppSec partnership can customize solutions to unique, government-specific domain areas and considerations. These include securing large legacy systems, eliminating technical debt, addressing end-of-support considerations and providing more visibility into hidden assets and asset dependencies.
Taken together, such efforts create an accessible, powerful and scalable AppSec approach that agencies can leverage to make their enterprise systems more secure, reliable and compliant.
Mark Townsend is vice president of professional services at Invicti Security.