AppCheck is pleased to announce official support for integration into Microsoft’s Azure Pipelines. In this post we perform a brief review of Azure Pipelines, before looking at how you can leverage an AppCheck integration to deliver cheaper and faster security coverage, at lower cost and with greater assurance.

What are Azure Pipelines?

Microsoft’s Azure Devops is linked tool-chain of technologies and services that leverage DevOps ideas and techniques to deliver efficient utilisation of its cloud hosting platform, Azure, in a way that provides continuous delivery/integration (CI/CD) and ensures higher overall software quality at lower cost. Azure Pipelines offer a simple way for teams to build repeatable and automated workflows integrating build, test, package and release steps in a neatly visualised and centrally managed cloud tool-chain.

“Shifting Security Left” & CI/CD Integration

Security can often be divorced from software development – the responsibility of a separate team who simply “check” deployed artefacts via late-stage quality-gates such as penetration tests on deployed web applications. The problems with this approach are considerable: culturally, such split-brain concerns lead to friction, frustration and delays. A recent IBM study found that incorporating testing for security issues during implementation – rather than as a latest stage quality gate – could be 15 times cheaper. Focus has unsurprisingly shifted to the adoption of ’shift-left’ security strategies, whereby security testing is conducted earlier within the SDLC. In its most simple terms, “shift left” security is moving security to the earliest possible point in the development process.

Benefits of incorporating security scanning into your Azure Pipeline

So if you already perform vulnerability scanning, what are the benefits to your team or organisation in integrating AppCheck into your Azure Pipelines?

Continuous Assurance
Penetration testing a deployed artefact or application provides a “one-off” assurance that the application is secure at a given point-in-time. However if your development team is using an agile or DevOps practices and your security team is not then there is an “assurance gulf” – a team deploying multiple times a day will swiftly move the application into a state whereby production code has been altered from “known good” state and assurance is lost. By comparison, vulnerability scanning via your Pipelines can be continuous and automated and repeated as often as every code deploy, providing ongoing assurance.

Shorter attack window

In security the “attack window” is an important concept representing the time gap that exists between introduction or creation of a vulnerability and its discovery and fix. If you rely solely on annual penetration tests, a vulnerability could exist on your deployed application for up to a year before being detected and sent for remediation. This creates a massively extended attack window that represents a significant opportunity for attackers to exploit your organisation.

Integrating security checks into your Pipeline, and scanning pre-deployment instances such as test and staging environments means that you can essentially reduce exploit availability to zero, patching all vulnerabilities prior to production release.

Quicker Fix
More regular vulnerability scan execution leads to the earlier detection of vulnerabilities and the need to consider or evaluate a far smaller change set for the source of the vulnerability, making it quicker and easier for the development team to identify the source of the vulnerability introduction from a smaller code delta, and make a smaller, more atomic fix in shorter timescale.

Deliver on Expectations
Quicker “fix as you go” leads to less late-stage delays and greater project delivery predictability – no more last minute blocks as the project hits late-stage security gates “wall” such as penetration tests and being delayed.