A New Approach to
Application Security
Stop Collecting Tools, Start Building a Foundation

Legit Security: A New Approach to Application Security

ALegit is a new way to manage yourapplication security posture for security,
product and compliance teams.
With Legit, enterprises get a cleaner, easier
way to manage and scale application security,
and address risks from code to cloud. Built forthe modern SDLC, Legit tackles the toughest
problems facing security teams, including
GenAI usage, proliferation of secrets andan uncontrolled dev environment. Fast to
implement and easy to use, Legit lets security
teams protect their software factory from end
to end, gives developers guardrails that letthem do their best work safely, and delivers
metrics that prove the success of the security
program. This new approach means teams
can control risk across the business —and prove it.

Book a demo today!

Legit Security: A New Approach to Application Security

BContents

2

6

13

Modern Software
Development:
More Speed, More
Sources, More Risk

Security Challenges
Introduced byModern Software
Development

How Attackers Are
Taking Advantage

16

20

27

Shortcomings of theCurrent Application
Security Approach

A New Approach
to Application
Security: Visibility,
Prioritization,
and Alignment

Don’t Install Security
Cameras Before
You Know the Layoutof the House

Legit Security: A New Approach to Application Security

1Section 1

Modern Software
Development:
More Speed,More Sources,
More Risk
From multi-cloud deployments to microservices,
containerization, artificial intelligence, automation,
CI/CD pipelines and DevOps, software development
has changed dramatically in recent years and is
now faster, more automated, more dynamic,
and highly reliant on third parties.

Legit Security: A New Approach to Application Security

2

Then and Now
Consider the
not-so-distant past

Fast forward
to todayArchitecture

Software had monolithic
architectures.

Most software is cloud nativeand built with a modern
microservice architecture.

Updates

It was updated quarterly,
semi-annually, or evenannually.

 eployments happen daily,Dsometimes even thousandsof times per day.

Development

There was a very real divide
between the way developers
created, tested, and rolled
out code for applications,and the hardware or virtual
machines used to hostthe code.

Everything can be built withcode, not just the application
itself, but the infrastructure,
the build pipelines, theautomation testing, andthe runtime environments.

Past

Today

Developers created code, then it
went to a completely different team
to deploy and operationalize. If they
got stuck on a piece of code, theywould post on Stack Overflow, ask
another senior developer, or researcha solution on their own — all of which
could take days.

Some organizations
have even adopted
development practices
that split teams into
pods that develop,
deploy, and maintaintheir own services
from code to cloud.

Legit Security: A New Approach to Application Security

3

Developers are now more self-sufficientand capable than ever before. They can build
not only their own apps, but also local test
environments that look identical to production
environments and pipelines for continuous
integration and deployment (CI/CD). With theadvent of containers, Kubernetes, and cloudarchitecture, they can quickly test, iterate,build, destroy and rebuild, all in a matterof minutes. If they have a question aboutbuilding or fixing code, AI will instantly givethem complete snippets of code, troubleshoot
why code isn’t working, or even give themreal-time suggestions while they code.
Add to this that development organizations
today can be huge, with thousands ofdevelopers, and grow exponentially almost
overnight due to M&A activity — and98%

of enterprises
deploy multi-cloudarchitectures, withdata distributed
across several
cloud providers.

you’ve got a dev environment that is more
fast-moving and fluid than anything we’ve
ever seen before.

While fostering an unprecedented levelof innovation, this software development
revolution has also greatly expanded
application attack surfaces.

Legit Security: A New Approach to Application Security72%

of containers live
less than 5 minutes,
reported by Sysdig.

4

Code

SCM

CI/CD

Artifacts/
Packages

Production/
Runtime

SourceSourceBuild

Artifacts

Artifacts

Production

Legit Security: A New Approach to Application Security

SourceSource

Build

Build

Artifacts

Production

5Section 2

Security
Challenges
Introduced byModern Software
Development
Modern software development
is making the security team’s job
increasingly challenging.

Legit Security: A New Approach to Application Security

6Three emerging and especially vexing struggles:

1

2

3

Visibility

Correlation

Complexity

Lack of visibility
into the fullsoftware factory,
from assets topathways andpipelines.

Lack ofcorrelation
among types ofrisk — such as
cloud, app, supply
chain — acrossthe SDLC, leading
to increased
manual efforts.

Complexity
leading to
misconfigurations
and the exposureof secrets indevelopment
pipelines.

Legit Security: A New Approach to Application Security

7

Visibility

Lack of visibility and context makeit hard to identify security risks
and comply with regulations
With the explosion of innovations like APIs, multi-cloud deployments,
containers, and AI-generated code, the attack surface has grownexponentially in recent years, and security teams are struggling to
get the visibility and context they need to effectively mitigate risk.

Generative AI
gives developers
an easier way to
produce codeat scale.

However, it also:• Creates a lower barrier of entry, allowing
non-technical users to leverage tools
such as GitHub Copilot to produce code.
• Generates code with vulnerabilities,
just like code created by developers.
• Could include code licensed by anotherorganization. This puts an enterprise atlegal risk of stealing intellectual property.
• Often leverages old recursive patterns thatdevelopers have stopped using, but thatare still on the Internet.

Legit Security: A New Approach to Application Security

8Beyond increasing risk, lack of visibility into the attack surface also createscompliance challenges. Security teams are struggling to comply withregulations requiring evidence of asset inventories and security controls.

Lack of visibility
makes complying
with regulations
more challenging.

For example, NIST SSDF requirements
include the following:
1

Prepare the Organization (PO)• Implement roles and responsibilities
in the SDLC.
• Implement supporting toolchains.
• Define and use criteria for software
security checks.

2

Protect the Software (PS)• Protect all forms of code fromunauthorized access and tampering.
• Archive and protect each software release.
3

Produce Well Secured Software (PW)• Design software to meet security
requirements and mitigate security risks.
• Reuse existing, well-secured software
when feasible instead of duplicating
functionality.
4

Respond to Vulnerabilities (RV)• Identify and confirm vulnerabilities
on an ongoing basis.
•A ssess, prioritize, and remediate
vulnerabilities.
• Analyze vulnerabilities to identify
their root causes.

Legit Security: A New Approach to Application Security

9Source

Build

Artifact

Cloud

Developer

Dependencies

Correlation

Silos prevent holistic viewof product security
Further complicatingrisk management
are the silos among
application, cloud,and security teams.

Although most applications are deployed in thecloud, application security and cloud security areoften two separate entities, leading to a lack ofcontext and clarity. For instance, if a vulnerability
is identified in a cloud environment, it can takehours for the cloud security team to work withthe application security and development teams
to locate the code creating the vulnerability.
Ultimately, neither of these teams are focusedon the big picture of the software factory,
leading to unidentified supply chain risk.
Developers are often also working in their own
silo, spinning up new repositories or servers
without the security team’s awareness or visibility.

Legit Security: A New Approach to Application Security

10Complexity

Increasing complexity opens up newopportunities for misconfigurations
and secrets exposure
The complexityof the modern
software factoryalso opens up
new avenues for:1

Risky
misconfigurations,such as of build
systems2	
Exposure of secrets,
such as API keys andcloud credentials

Misconfiguration mayhem
With the software development factory
becoming more complex and automated,
there are increasing opportunities for
misconfigurations to create risk. For example,
misconfigured build servers is a common
problem that creates significant vulnerabilities.
Build systems are essentially automated,
implicitly trusted pathways straight to the cloud,yet most aren’t treated as critical from a security
perspective. In many cases, these systems —like Jenkins, for example — are misconfigured
or otherwise vulnerable and unpatched.
Oftentimes, development tools are overprivileged because they’re easier to integrate
if users have full access. In some instances,organizations spin up an open-source
development server and then allow admin
access to everything. They’re not worried
about misconfigurations; they’re focusedon application vulnerabilities.
In fact, this type of misconfiguration was
the source of the SolarWinds and the
Codecov attacks.

Legit Security: A New Approach to Application Security

11Secrets in the spotlightModern apps require hundreds of secrets
to function (API keys, third parties, cloudcredentials, etc.).
At the same time, developers are pushed toinnovate and develop code as fast as possible,
frequently leading to shortcuts intended to drive
efficiency and speed. One of those shortcuts
is using secrets in development to acceleratetesting and QA.

#2According to IBM’s
2023 Data Breach
Report, secret leakrisks are the second
most common initialattack vector.

The problem is that it’s very easy for these
secrets to remain exposed. For example, adeveloper may test a piece of code with a key.
When it works, they move it into production
without removing that key. They either
forget, or the key works and they don’t
want to adjust it.
This practice and others like it lead to acontinuously growing and significant sourceof risk to the organization.

12:100Legit Security has found an
average of 12 secrets submitted
per 100 repositories every week.

Legit Security: A New Approach to Application Security

12Section 3

How Attackers Are
Taking Advantage
To take advantage of the vulnerabilities createdby modern software development environments,
sophisticated attackers have expanded theirfocus beyond front-end applications.

Legit Security: A New Approach to Application Security

13

Now, attackers also increasingly target
software supply chain factory components(pipelines, build servers, libraries, tools,
and processes).
Expert nation-state attackers and professional
cybercriminals know that infiltrating software
supply chains and injecting malicious code isa one-to-many type attack that gets them morebang for their buck. The target organization
will unknowingly send the code to hundreds
or even thousands of customers or internal
users downstream. Attacks like these have
led to massive global breaches, such as thoseat 3CX, SolarWinds, Codecov, and CyberLink.
And those breaches have led to downstream
customers being compromised as well, as wasseen in the SolarWinds, Codecov, and recent
Microsoft attacks. This could, and has in thepast, allowed attackers to nest supply chain
attacks, creating wide blast radiuses.
3CX was one of the first nested supply chain
attacks. A developer from another company atTradewinds (trading software) was compromised.
The attacker injected malicious code into thesoftware that was then downloaded by adeveloper at 3CX and allowed the attacker tobreach the 3CX environment. They then moved
laterally through the software supply chain andmade malicious changes to code, which wasthen sent to 3CX clients, including Fortune 500
companies and the federal government.

Legit Security: A New Approach to Application Security

633%
increase insoftware supply
chain attacks(88,000 attacks
in a 12-month
period), reported
by Sonatype.

61%of U.S. businesses
were directly
impacted by asoftware supply
chain attack inthe 12-month
period endingin April 2023.

14

Attacker

Tradewinds
Software

3CX

Compromised
ClientCompromised
ClientCompromised
Client

The impact of a software supply chain attack:• Lateral movement• Intellectual property leak• Customers’ data leak

• Backdoors

There’s still a need for strong application security controls
inside of applications. However, the more devastating
attacks are largely coming through software supply chains.

Legit Security: A New Approach to Application Security

15Section 4

Shortcomingsof the Current
Application
Security Approach
Bottom line: The current approach toapplication security doesn’t align with the way
development works, or the way attackers do.

Legit Security: A New Approach to Application Security

16

Most security teams today approach
application security by scanning sourcecode in several ways:• Static analysis (SAST)• Dynamic analysis (DAST)• Software composition analysis (SCA)• Pen testing
These scans are conducted in different
phases of code development and often bydifferent teams — for instance, static analysis
and SCA are often conducted earlier in thecoding phase, whereas dynamic analysis,
pen testing, and now next-gen SCA are
typically seen later in runtime testing.

This approach falls
short because its
focus is too narrow,it lacks context,
and it produces
a variety of results
without correlation.

Highly Vulnerable
Attack Surface Area
SourceBuild

Artifact

Production

Developer
Dependencies

Legit Security: A New Approach to Application Security

17

Correlation conundrum
It’s time-consuming to correlate all the results
coming from different AppSec tools. There
are too many dashboards creating noise,and sometimes even conflicting or duplicate
information. For example, with each producing
its own list of weaknesses or vulnerabilities,
SAST, DAST, and pen testing often produce
overlapping results.

Bottom line:
You could end up
chasing down thesame issue in
multiple tools.

Context crisis
With different tools scanning code in different
ways across the development lifecycle, AppSec
tools also generate a lot of results without a lotof context.
Security teams often assign developers all
critical vulnerabilities to fix, but assigning
developers to vulnerabilities just to lower ametric does not provide value if fixing thosevulnerabilities doesn’t impact the businessor reduce the risk to the environment.
It’s not a matter of just prioritizing which
vulnerabilities to fix first based on the CVSS
score of the vulnerability. It’s also about
assessing the business value of fixing
vulnerabilities that are more risky because
they impact high-value business applications
that involve revenue, customer interactions,or sensitive data.

Legit Security: A New Approach to Application Security18

By relying only on tools to build an application
security program, it’s difficult to efficiently
identify all the risks and understand how toremediate those risks in a way that is contextual
to the environment. Without contextual risk
ranking among applications and vulnerabilities,
either “everything” is a priority, or “nothing”
is a priority.
Additionally, time, money, and effort could bespent fixing something deemed critical by anoutside entity that doesn’t actually represent
real risk to the organization, whereas othervulnerabilities or weaknesses that are risky
to the organization are overlooked due to lowclassifications from things like CVSS or EPSS.

Focus failure
Scanning source code is a critical part ofapplication security, but it’s only a part, andit needs to be streamlined.
“Shift left” is the right approach, but when you
shift everything left, not just the critical issues,
developers are inundated and don’t have aclear focus.
In addition, most AppSec tools only lookat application risk and largely ignore the risk
found in the software factory, like weaknesses
in the CI/CD pipeline. This focus leads to blind
spots in the area that’s currently causing andproducing the most devastating attacks seenin the wild.
Legit Security: A New Approach to Application Security

Ultimately, application
security tools work
more effectively
and efficiently witha solid foundation
underneath them.

19Section 5

A New Approach
to Security:
Visibility,
Prioritization,
and Alignment
To sync with the way today’s attackers
and developers work, enterprises must
break down their security silos.

Legit Security: A New Approach to Application Security

20

Breaking down security silos requires focusing themission on overall product security — rather thancreating silos for cloud security, application security,and other components of the software supply chain.
It also calls for one platform that can corral thechaos, scale as development organizations grow andchange, and offer a clear view of the full software
factory, its assets, its owners, its security controls,
its vulnerabilities, and how all are related.

Benefits of Application Security
Visibility, Prioritization, and AlignmentMitigates high-priority security
vulnerabilities to intelligently
reduce risk.

Streamlines regulation
compliance by proving
where controls are deployed.

Uncovers shadow IT,
systems, and source code.

Evaluates application
business criticality.

Measures the blast radius ofvulnerabilities—the potential
impact of a security breach
within a system.

Provides a common language

Provides guardrails thatallow developers to move
fast without security controls
slowing them down.

Shows progress in reducing risks.

for executives, developers, andsecurity teams to understand risks.

Legit Security: A New Approach to Application Security

21

Code

Developer

Build

Configure

Artifact

RuntimeOne App

One App
Enterprises need an approach that would
take application security and cloud security
and look at them through the lens of
one application.
This shift includes rethinking the definition ofan app to include stages from code, throughthe build process, configuration, artifact
management and into runtime.
To protect against software supply chain attacks
and comply with regulatory mandates, enterprises
should consider a comprehensive application
security program that simultaneously assesses
and addresses all risks across the entire SDLC
holistically. The risks found in one area of an
SDLC interrelate with risks found in every otherarea of the SDLC due to the nature of the way
cloud native applications are built.

Legit Security: A New Approach to Application Security

22

From Code to SDLC
Rather than assuming development pipelines
are secure, assume they are insecure until
proven otherwise.
The first goal should be to determine which
existing risks require the most immediate
attention. Identify all the components andharden the entire SDLC, not just the code.
Establishing this visibility is similar to the current
approach to endpoint and network protection —where security teams collect a complete list ofassets and a map of the environment to knowwhat to protect.
Creating an automated SDLC asset inventory
for development pipelines will allow security
teams to apply security policies to thatinventory and check for risky violations —quickly and accurately. Threat modelingwill then allow the team to identify risky
implementations before starting development.

Legit Security: A New Approach to Application Security23

To enable comprehensive application security, aim for:Centralized Visibility
across all phases of the software factoryThis gives everyone an end-to-end understanding of all SDLC
assets and allows them to answer the key questions about
applications, products, build tools, and controls:• Who’s developing the code?
•	What’s in your code?

(i.e., secrets, AI/LLM, vulnerabilities, sensitive data)•	Do we know when new build assets or artifacts are created(preventing shadow IT)?
• Do we have a complete SDLC asset inventory?
•	Can we verify correct configurations across all tools
throughout the code factory?
• Where and how does code go through pipelines?
• Where does code end up in production environments?
•	How is code protected in pipelines and production environments?
• Can we triage and prioritize issues based on business risk?

As these questions are answered, security teams
can see where security gaps exist and more easily
comply with regulations.

Legit Security: A New Approach to Application Security

24

Contextual Prioritizationof the overall development environment

This allows teams to make the rightsecurity decisions by:•	Determining the risks in each stage of the SDLC.
•	Identifying how those risks correlate acrossthe software factory.
•	Selecting which vulnerabilities to fix first basedon the impact on the business.

Avoid assuming all critical vulnerabilities
must be prioritized. They may be associated with
low-level applications and code repositories.

Legit Security: A New Approach to Application Security

25

Organizational Alignment
To sync the knowledge and the efforts ofdevelopers, security teams, and executives to:• Explain where the risks are and why.
• Identify the required resources to fix risks.
• Inform why it’s important to fix certain
vulnerabilities and put others on the back burner.
• Strengthen internal relationships by providing
dashboards showing vulnerability status.

Everyone realizes which risks need to be fixed
and why. This is more powerful than using
arbitrary numbers from an outside entity that
doesn’t have any idea how the business is run.

Legit Security: A New Approach to Application Security

26

Section 6

Don’t Install
Security Cameras
Before You
Know the Layoutof the House
Scanning code without a solid foundationof SDLC visibility is like installing security
cameras without first understanding
entrances, exits, high-traffic areas,or where valuables are kept.

Legit Security: A New Approach to Application Security

27

Sophisticated cybercriminals now focus theirefforts on the expanding attack surfaces ofsoftware supply chains. Make sure they don’t
understand the “layout of the house” better thanyou do. It’s time for security strategies that go
beyond scanning of applications to proactively
lay a foundation of centralized risk visibility andvulnerability prioritization.
The best way to secure applications from coding
to the cloud is real-time application security posturemanagement that provides visibility, prioritization,
and alignment among internal teams to ensure theintegrity, governance, and compliance of every
software release.
It’s not enough to just manage security issues;
enterprises must prevent issues by centralizing
security policy enforcement across all applications,teams, and pipelines — with real-time updates
on security issues, configuration changes, andcompliance drift.

Learn how enterprises like Kraft-Heinz
and Netskope are taking a new approach
to application security.

Legit Security: A New Approach to Application Security

28

Visit our website to book a demo
and learn more about the Legit
Security Platform.
Get best practices on software
supply chain security from our blog.
Follow us on LinkedIn for the latest
news, events, and content.

Legit Security: A New Approach to Application Security

29