Published December 2, 2020

WRITTEN BY THE KIUWAN TEAM
Experienced developers, cyber-security experts, ALM consultants, DevOps gurus and some other dangerous species.

As business management expert Peter Drucker once put it: “If you can’t measure it, you can’t improve it.” This quote feels right in place in the world of application security.

Many CISOs are finally starting to give SAST tools and other approaches the attention they deserve. However, the only way to know if your approach works is by using app security and quality analytics. 

While there are many security metrics you can track and assess, choosing the ideal ones for your company is of paramount importance.

It’s the best way for CISOs, developers, and other stakeholders to gauge the application’s effectiveness and improve its efficiency.

Why Application Security Analytics Matter

Arguably the most important part of any application security plan is determining the key data analytics to track.

For instance, many CISOs want to see a drop in the number of new malware attacks targeting an application (making this an important analytic to track). A drop in this figure over time shows an improvement in secure coding practices within the team.

Allowing your security professionals to have access to real-time analytics is also important. It goes a long way to improving their efficiency. 

Some of the analytics they should access with ease includes:

• Data regarding the type of threats being identified
• How they are discovered
• And the time it takes to remedy them. 

Another thing to remember is that there is both direct and indirect analytics you can track. Direct analytics gauge the security of the program itself, such as the exact number of known threats. Indirect analytics go above and beyond the program and, instead, target practices, tools, and people. A blend of direct analytics and indirect analytics paints the most accurate picture of how your application security (AppSec) tools work.

Without these analytics, CISOs will attempt to secure their programs blindly, with limited capacity to deliver quality business outcomes.

Six AppSec Analytics To Improve Application Security & Quality

1. Total number of application threats and their severity

This is arguably the most vital application security and quality metric for your organization. 

It’s prudent to know the exact number of weaknesses present in an app, and more importantly — just how severe each threat is. Severity depends on the effect the weakness can have on the app (and the company at large) and how often it is likely to happen.

The best way to pinpoint the biggest weaknesses is to leverage the outcomes from Dynamic Application Security Testing (DAST) tools and Static Application Security Testing Tool (SAST) tools like Kiuwan. Click here to read more about these testing tools.

SAST tools single out potential threats in the source code, while DAST tools show you which of these weaknesses can actually lure attackers.

Leveraging results from both SAST and DAST tools will enable you to draft a list of the weaknesses that pose the most significant threat to the program. Better yet, your team can use these analytics to identify issues that require immediate remediation.

2. Number of new threats detected

In agile software development, new releases and updates are quite common. It’s vital to know the exact number of new threats discovered when a program is deployed.

This analytic helps CISOs keep better track of threats. It also helps executives gauge the efficiency of developers in relation to writing secure code. 

3. Average days to remediation

The longer it takes to patch a vulnerability, the more time cybercriminals have to exploit it. 

CISOs and other security professionals need accurate, real-time data on how long it usually takes to patch loopholes in the application after they’re identified.

As a security executive, you can break down these analytics in terms of severity. This enables you to see how much time it takes to solve crucial issues versus those that fall into the low, medium, or high severity categories. You’ll also be able to identify inconsistencies in the resolution process. 

4. Types of threats discovered

Knowing the most prevalent vulnerabilities likely to impact your software is also vital. For instance, having analytics showing that DOS (Denial-of-service) attack is your most common risk allows you to allocate teams and resources to improve resolution times.

5. How threats are identified

It helps to know which processes, practices, and tools are identifying weaknesses. Analytics showing the total number of threats found by QA (code analysis), SAST tools, penetration testing, and other detection techniques will give you a grasp of how effective your AppSec testing is and if any vulnerabilities need to be remedied.

6. Origin of threats

Going a level deeper, wouldn’t it be helpful to see the threat’s genesis, including the country and IP addresses? 

Analytics relating to the origin of risks can help you view the application security testing holistically- from an attacker’s perspective. 

Besides, this data allows the CISO to gauge whether certain IP sets and countries pose a real threat to their AppSec approach and if so, remediate them proactively.

The Challenge Of Analytics in Application Security

Application security is a fast-changing beast of new technology – old weaknesses exploited in new ways, new threats exploited using new technology. Simply put, it’s incredibly dynamic. 

The rapid pace of app development, coupled with the vast amount of inaccurate and inconsistent data, does make it hard to know if what you measure today will help you enhance your security approach for the better.

This is because it’s pretty hard to keep track of your activities in the entire software lifecycle.

Failure to prove your success in tangible numbers to the business could be your undoing. You might find yourself hard-pressed in receiving management support and finances for your AppSec practices and processes.

With real-time analytics of what specific threats are undermining your application security, however, you’ll go the extra mile in protecting the business. You’ll also be doing your duty in helping your team overcome revulsion to agility.

Kiuwan: The Perfect Tool to Assist with AppSec Analytics

Tracking, digesting, and displaying AppSec analytics requires the right tool — and Kiuwan ticks all the right boxes.

Our tool displays all of your analytics in one place, so you can seamlessly track your app’s security progress. For instance, vulnerabilities by type, by language, and by priority are in one place and within a single click. Interactive visuals allow CISOs and other security professionals to dive deeper into issues of concern. 

The best part? Kiuwan Code Security integrates with leading DevOps tools and covers over 300 languages, making it the perfect tool to track your app security and quality- today and well into the future!

Would you like to know more about how you can use Kiuwan to analyze your application and generate meaningful metrics? Get in touch with our Kiuwan team! We love to talk about security.