All federal agencies have been making strides towards Zero Trust compliance to comply with the Executive Order on cybersecurity. But the need to meet the mandate isn’t the only reason that agencies must implement a Zero Trust architecture; the constant onslaught of evermore sophisticated security threats have made Zero Trust architecture imperative. To support agencies on their path to enterprise-wide cybersecurity, General Services Administration (GSA) recommends that agencies invest in an application security testing program that goes beyond automation to effectively reduce vulnerabilities and mitigate risks.
At an event hosted by Next Gov, Bo Berlas, the GSA’s Chief Information Security Officer explained the work being done to improve software and supply chain security practices. “To truly be able to achieve synergy and value and be able to integrate that into a security strategy, [improved software and supply chain practices] has to effectively be developed and delivered as an enterprise shared service,” Berlas said. “We’re essentially going through and doing a lot of investment within this space in the coming year by centralizing around a dedicated, app-sec solution, backed by tooling and people that effectively provide integrated support services into our agency application teams.”
Since application security testing encompasses such a broad array of technologies, finding the right solution depends on many factors. A recent eGuide published by HCLSoftware provides insights into how agencies can find the right application security testing solution and best practices for implementing a security-first mindset.
Before choosing an application security testing solution, agencies should first identify key stakeholders to ensure continuous monitoring of applications, encourage a security-first mindset, and incorporate internal and external security policies to achieve enterprise-wide security. Reducing the number of vulnerabilities is only one element of an effective application security testing solution. By identifying and addressing the root cause of vulnerabilities, agencies will have greater insight into their application security posture and will be better equipped to mitigate the impact of exploited vulnerabilities on critical data and systems.
In an interview with Government Technology Insider, Emily Baugher, Head of US Federal at HCL Software, discussed how cybersecurity must be incorporated at every stage of application development and beyond. “Agencies must integrate cybersecurity best practices from day one of development,” Baugher said. “Agencies need application security testing solutions that continuously monitor applications and address vulnerabilities at the root of the problem to avoid future data breaches. By integrating a security-first mindset, agencies will ensure that applications are secure upon release to prevent data breaches and protect citizen and employee data.”
While Zero Trust will create the framework for a stronger national cybersecurity posture, it’s critical that agencies continue to improve security practices across the board. The next step for agencies is to follow the GSA’s guidance and invest in application security to address vulnerabilities at the source and reduce the attack surface.
To learn more about what to look for in an application security testing solution, download the eGuide below.