Backslash Security today added an ability to simulate upgrades to a higher version of an application to its application security platform for scanning code and creating software bills of materials (SBOMs).
Additionally, the company is now also making use of large language models (LLMs) to provide DevSecOps teams with guidance to remediate issues without ever exposing any code to the LLM.
Amit Bismut, head of product for Backslash Security, said one of the challenges that DevSecOps teams regularly encounter is that an update to, for example, a third-party package or module that has been included in an application might introduce additional vulnerabilities. The Fix Simulation capability added to the Backslash software-as-a-service (SaaS) platform makes it possible for DevSecOps teams to verify how that software will impact their applications without having to first deploy it in their IT environments, said Bismut.
That’s critical because DevSecOps teams often debate the degree to which a minor or major update to a software package or component might be required to ultimately secure an application, noted Bismut.
At the same time, DevSecOps teams can take advantage of the BackSlash platform to expose metadata of an application environment collected by Backslash to an LLM, which then can generate attack path remediation recommendations to fix vulnerabilities. That approach eliminates the need to ever expose the code created by an application developer directly to an LLM, said Bismut.
Application Security Posture Management
The Backslash application security posture management (ASPM) platform identifies and prioritizes vulnerabilities based on how easy they are to exploit and reach. That approach makes it possible to visually model threats within the context of the actual application architecture, all the way down to specific lines of code and the developer that wrote them.
Capabilities include a vulnerability exploitability exchange (VEX) platform integrated with tools for software composition analysis (SCA), static application security testing (SAST), secrets detection and creating SBOMs.
Streamlining DevSecOps workflows has become crucial in an era where thanks to the rise of artificial intelligence (AI) the amount of code being written and deployed is about to exponentially increase. Unfortunately, developers still only allocate about 10% of their time to remediate vulnerabilities. Organizations need to be certain that time is spent addressing issues that could have the most impact on the business. Otherwise, a level of fatigue sets in, resulting in developers making the same cybersecurity mistakes over and over again. Most of the vulnerabilities discovered in applications today are the same issues that have plagued software engineering teams for the past decade.
There are, of course, multiple DevSecOps options ranging from providing developers with additional tools that discover vulnerabilities and code is written, to adding additional gates to existing DevOps workflows to ensure vulnerabilities are not committed to a software build. Regardless of approach, it’s clear cybercriminals are becoming much more adept at exploiting known software vulnerabilities. As such, it’s only a matter of time before the next time one of those vulnerabilities is exploited and it will be traced back to the developer who created it.
