Its always a good thing to take a step back every once in a while to take the lay of the land. Like you, we are always working at a breakneck pace to help secure the web applications being built today and ready ourselves to secure the innovations of the future. When Forrester put out [The State of Application Security, 2022]() report a few weeks ago, we thought it was a great time to share where we think AppSec is headed and several places where we agree with Forresters take on the state of play.
Here are a few of the highlights.
## Modern apps require end-to-end SDLC coverage
When we think of the [software development life cycle (SDLC)](), there is always a key focus on [shifting left.]() This makes sense: We want to find security vulnerabilities earlier to save time, money, and risk exposure in production. However, if theres one thing weve learned in the last 12 months with recent emergent threats, its that no matter how much you try to secure your applications pre-production, you still need to have runtime protections in place for your business-critical applications. The Forrester report notes that the idea of shift everywhere seems to be gaining traction, which is inclusive of shifting both left and right. According to Forresters report, 58% of global senior security decision-makers plan to increase their application security budget this year. We can expect the spend on tooling across the SDLC to be prioritized.
An example of this highlighted by recent vulnerabilities such as [Log4Shell]() and [Spring4Shell]() is the adoption of software composition analysis (SCA) in-production. While finding and fixing third-party packages with vulnerabilities in pre-production environments is absolutely critical, customers are also going to require production coverage for open-source libraries. Rapid7 tools have helped our customers detect vulnerable third-party packages in their runtime environments. You can check out more how we helped our customers do this at [this blog]().
As infrastructure continues to become code and modern development technologies such as containers are adopted, the risk associated with these technologies grows as well. This modern approach to application development means investment in modern security practices like container and [IaC scanning]() are key to a best-in-class AppSec program.
## APIs are growing, as is their risk
APIs are the way in which modern applications communicate. Nearly every modern application utilizes one or multiple APIs or even is an API. API usage continues to rise across the world and attackers have started to take notice. Malicious API traffic almost doubled from the timeframe of Dec 2020 to January 2021, Forrester reports.
APIs are now clearly a part of organizations growing attack surface, and their importance will continue to grow over the next few years. That means they need to be a critical component of any security program. There are many ways to secure APIs, including proactively scanning and monitoring them for any malicious activity.
## Developers influence is increasing
Between the threats weve experienced from vulnerabilities in open-source software components and the fact that open source accounts for 75% of audited code bases, as Forresters latest State of Application Security Report points out, we see the growing need for including developers in security decision-making. Development teams are critical stakeholders and often, they need just as much input when it comes to what security tools and practices to implement.
As modern applications require modern development technologies, development teams are looking to partner with security teams on ways to implement compensating controls, without slowing down the speed of development. We can continue to expect an increase in the influence that development teams will have on security programs.
These are just a few highlights about the current state of application security and the trends that will shape it this year, next year, and years to come. As always, we will keep our finger on the pulse of application security and help to drive the practice forward to help you keep your organization safe.
_**Additional reading:**_
* _[API Security: Best Practices for a Changing Attack Surface]()_
* _[How to Secure App Development in the Cloud, With Tips From Gartner]()_
* _[3 Takeaways From the 2022 Verizon Data Breach Investigations Report]()_
* _[Find, Fix, and Report ?OWASP Top 10 Vulnerabilities in InsightAppSec]()_
#### NEVER MISS A BLOG
Get the latest stories, expertise, and news about security today.
SubscribeRead More