SaFi Bank Space : Application Security

 Overview

Application security is an important part of SDLC as this ensures the security is embedded within the application by design. Now it is integrated in DevOps process which becomes the commonly called as DevSecOps. The application security is managed in 2 different parallel process, Proactive and Reactive.

Proactive focuses on development of new features or change in the application ensuring proper security controls is in-place. While Reactive focuses on the operations wherein the application is continuously monitored and tested for vulnerabilities, threats, and gaps.

Life Cycle

For each new features and change, the application security starts by assessment and engineering which screens, models, and design the security requirements. All identified gaps should be addressed in development and verified on the testing process. Once deployed in production, it is continuously monitored on operations for new threats, vulnerabilities or gaps. Identified items will be handled in vulnerability management process and addressed in Gap Analysis and Remediation Plan process through vulnerability response procedures.

Baseline

The application security baseline is made up of guidelines. Each guidelines serves as minimum requirements to consider along the SDLC. Guidelines set the expectations for features or changes what minimum security controls is needed and what level of security is expected based on the screening process.

Baseline:

• Third Party Application Security Testing Guideline

• Security Testing Guideline

• Secure Coding Guideline

• Hardening Guideline

• Crypto Guideline

• Deployment Guideline

Testing

Application security testing will be performed by internal teams and external 3rd party vendors. The scope, framework, and methodologies is the same. Both should follow OWASP based standard procedures in performing the testing to target scope.

The only difference between 3rd party and internal team will be the strategy. By default, 3rd party will be allowed to perform security test to applications but with security controls in place. The controls can be whitelisted if needed but requires approval and can only be allowed within the agreed time period.

Internal team on the other hand can perform the testing directly to the application without controls but only within agreed time period allowed by the business.