Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

4/17/2019
02:30 PM
Tim Buntel
Tim Buntel
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Legacy Apps: The Security Risk Lurking in Dusty Corners

Four best practices to keep old code from compromising your enterprise environment.

A successful DevOps transformation empowers teams to release applications and add value for their organization faster than ever before. And now, with DevSecOps emphasizing early, integrated testing, security is being built into that high-velocity process. It's a tremendous improvement over past approaches in which security was tacked on to the very end of the development pipeline.

Still, many enterprises, even those with mature DevSecOps processes, tend to overlook a significant risk in their application portfolio: legacy apps that predate these improved processes. These application inventories include apps that may not have had a code change in years — and certainly weren't built using the best modern DevSecOps processes. Attackers know this and are happy to exploit it. A neglected segment of an organization's technology stack that is no longer monitored or cared for could be an attacker's ideal point of ingress.

These apps, lurking in dusty corners, might be used daily and no longer be under active development. Or they might be used infrequently, in forgotten production environments. Either way, they represent real risk for the business. The good news is that smart security teams that follow the four best practices below can mitigate the threats of legacy app-related security incidents.

Best Practice 1: Address "Tech Debt" Regularly and Incrementally
There's no escaping the fact that updating, monitoring, and maintaining legacy apps takes time, and, much like a sink full of dishes or a pile of dirty laundry, these tasks only become more time-consuming the longer they are put off. Rather than letting this "tech debt" become too daunting, it's worth considering dedicating a portion of the development team's time to reducing their maintenance efforts. This could involve the creation of a dedicated sprint team that takes turns owning this initiative or a by focusing a small percentage of each team's bandwidth on securing legacy apps and code on a regular basis.

Best Practice 2: Leverage Standards and Compliance Requirements
Associations like the National Institute of Standards and Technology (NIST) establish security guidelines and regulations specifically to help organizations achieve sound security postures. Cross-referencing legacy code against industry-approved frameworks can be a good method for identifying security flaws, making the security audit process a much less daunting task.

Best Practice 3: Maintain an Accurate Application Inventory
A critical step in addressing legacy app-related risk is establishing what apps are running on the corporate infrastructure. Start by creating a single catalog of applications and dependencies running in the corporate environment — including third-party apps and components. List each application's name, technology stack, purpose, users, and who in the organization may have firsthand knowledge of its implementation. This can be an arduous task, but if businesses employ policies to keep the inventory current after the initial lift, it's worth it.

Best Practice 4: Security Policies for Removing Legacy Apps
As organizations grow, workflows shift, and different team members become reliant on different applications. To deal with this constant state of change, IT and security teams need to implement a plan and process for reviewing the technology stack and sunsetting applications that no longer serve a business function. If the business is not getting anything out of an internal or third-party application, it is simply a potential source of risk with no corresponding reward.

A comprehensive security strategy must be just that: comprehensive. Modern businesses must account for every segment of the technology stack, not just those components being actively developed today. By following these guidelines, organizations will better understand the potential risk that legacy apps pose, and how to protect themselves from these risks before they become problematic.

Related Content:

 

 

 Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Tim Buntel is vice president of application security products at Threat Stack. Prior to this role, Tim has built globally-recognized software businesses for 20 years at startups, mid-sized companies in transition, and the largest global brands, including Atlassian, Adobe, ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
4/17/2019 | 2:52:19 PM
And machines too
Every firm has a legacy system, one old Compaq Prolinea that has weird or ancient software installed on it 20 years ago that is used every 30 days to run a reel-to-reel data tape.  (Aon had one of those).  And those can be stuffed anywhere in a firm too.  So an inventory of these specific machines is important.  Another hole are special use machines like a UPS shipping computer.  Supported by God knows who and rarely updated with patch.  These little nuclear bombs are also scattered around in a dark department cove.   Lastly, and these are not turned on perhaps, just old old computers never thrown out. Not a direct threat but still, if disposed of, a hole out there.  
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/4/2020
Data Loss Spikes Under COVID-19 Lockdowns
Seth Rosenblatt, Contributing Writer,  5/28/2020
Abandoned Apps May Pose Security Risk to Mobile Devices
Robert Lemos, Contributing Writer,  5/29/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13777
PUBLISHED: 2020-06-04
GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TL...
CVE-2020-10548
PUBLISHED: 2020-06-04
rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
CVE-2020-10549
PUBLISHED: 2020-06-04
rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
CVE-2020-10546
PUBLISHED: 2020-06-04
rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
CVE-2020-10547
PUBLISHED: 2020-06-04
rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.