Threat Assessment: Ignoble Scorpius, Distributors of BlackSuit Ransomware
Threat Brief: Operation Lunar Peek, Activity Related to CVE-2024-0012 and CVE-2024-9474 (Updated Nov. 19)
FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications
See all Unit 42 Threat Research
Table of Contents
Cloud Security

What Is Code Security?

3 min. read
Table of Contents

Code security refers to embedding security into code. Unlike traditional cloud security posture management and cloud workload protection solutions, cloud code security focuses on code with several use cases, including infrastructure as code (IaC) security, application code security and software supply chain security.

Cloud-native technologies, such as IaC and containers, combine application and infrastructure development principles, allowing for greater flexibility, scalability and usability. These technologies have not only changed the way we build the cloud but also how we secure it.

IaC Security

Infrastructure as code is a modern technology and process in which infrastructure is provisioned and managed using machine-readable code files. Frameworks such as Terraform and CloudFormation allow teams to write declarative or imperative code files, check those files into their version control system and CI/CD pipeline, and then spin up the cloud resources across environments.

IaC introduces new security considerations that traditional approaches to security don’t address. Traditional security typically monitors for cloud security issues, also known as misconfigurations, in runtime environments. With IaC, one misconfiguration in a code file can lead to thousands of misconfigurations and alerts across cloud environments.

Figure 1: A secure IaC template through to deploy and runtime phases of the development lifecycle

Figure 1: A secure IaC template through to deploy and runtime phases of the development lifecycle

Code security solves this by surfacing security feedback earlier in the development lifecycle instead of taking a reactive approach. Addressing misconfigurations during the development and build phases allows for faster and cheaper remediations – before deployment. This reduces noisy alerts that security teams have to triage and cuts down on the time engineering spends addressing issues ad hoc.

The key to a successful code security strategy for IaC is ensuring security is embedded directly in developer tools and workflows. By surfacing actionable feedback in code and embedding security guardrails in the build pipeline, IaC security empowers developers to ship infrastructure that’s secure by default.

Application Code Security

Code security for applications focuses on identifying known vulnerabilities in source code, dependencies and open source packages. Vulnerabilities, specifically Common Vulnerabilities and Exposures (CVEs), can introduce security risks across an application’s development stages, but code security focuses on the application code itself.

A strong code security strategy relies on secure coding best practices and code reviews to identify vulnerabilities. Through automated testing with technologies such as static application security testing (SAST) for custom code and software composition analysis (SCA) for open source code, code security solutions complement cloud workload protection by identifying CVEs as early as possible.

Again, the key to a strong code security strategy for applications is to provide actionable vulnerability findings to the people with the most context and knowledge about the code: developers. This is achieved through developer integrations and granular controls for how compliant versions can be bumped.

The other key to a cohesive code security strategy is context and visibility between infrastructure misconfigurations and application vulnerabilities. The lines between infrastructure and applications are blurred within cloud-native applications. Infrastructure is the foundation on which applications run and thus are inextricably linked. The same goes for security.

Having visibility into both the infrastructure and application layers of cloud-native applications improves teams’ ability to prioritize and address security issues based on their real-world exploitability. Improved visibility also enables teams to more quickly patch identified vulnerabilities, revoke overly permissive access, and lock down the relevant virtual machines (VMs) to minimize an attack’s blast radius.

Software Supply Chain Security

Software supply chains comprise application and infrastructure components as well as the underlying pipelines, including version control systems (VCS), continuous integration and continuous deployment (CI/CD) pipelines, and registries. And a cloud-native application is only as secure as its weakest link. So that’s why securing those delivery pipelines is also an essential part of code security.

If a VCS isn’t securely configured, attackers may be able to merge malicious code or get access to exposed secrets that could lead to a larger attack. And if CI/CD pipelines are compromised, attackers can gain access to exposed credentials and tamper with code, which can result in downstream incidents. Supply chain security best practices focus on hardening pipelines and configuring access controls and branch protections to restrict access as much as possible.

Figure 2: Secure components and pipelines within a software supply chain

Figure 2: Secure components and pipelines within a software supply chain

Software supply chain security is an important part of a strong code security strategy, as is understanding the connections between pipelines and infrastructure and application code across the development lifecycle. By increasing visibility across software supply chains, code security solutions enable teams to fully take advantage of all the benefits of cloud-native technologies and secure their infrastructure from code to cloud.

Code Security FAQs

Interactive application security testing (IAST) assesses applications from the inside during runtime, combining the benefits of SAST and DAST by analyzing code for vulnerabilities while it is being executed. IAST tools are integrated into the application environment, providing continuous feedback to developers as they code, enabling immediate identification and remediation of security issues.
Static application security testing (SAST) examines source code for potential security vulnerabilities without executing the program. It's performed early in the development lifecycle, enabling developers to identify and remediate security flaws during coding. SAST tools analyze code against a set of predefined rules to detect issues like input validation errors, insecure dependencies, and other common vulnerabilities.
Dynamic application security testing (DAST) assesses applications during runtime, simulating external attacks to identify vulnerabilities. Unlike SAST, DAST evaluates the application from an outsider's perspective, checking for issues like SQL injection, cross-site scripting, and other flaws exploitable without access to source code. DAST provides insights into real-world attack scenarios and the application's behavior in production.
Software composition analysis (SCA) tools audit codebases for open-source components and their dependencies to identify known security vulnerabilities, licensing issues, and outdated libraries. SCA automates the process of tracking third-party software used in development, crucial for maintaining the security integrity of applications and adhering to compliance standards.
Access control in code security is implemented through authentication mechanisms, ensuring only authorized users can access specific functions or data. Developers write code to define and enforce access policies, often using role-based or attribute-based access control models. They also employ techniques like multi-factor authentication and least privilege principles to minimize the risk of unauthorized access.
Code obfuscation transforms readable code into a form that is challenging to understand and reverse-engineer. It is used to protect intellectual property and prevent tampering or theft of code. Through techniques like renaming, control flow alteration, and encryption, obfuscation makes it difficult for attackers to analyze the code and exploit potential vulnerabilities.
The purpose of code review is to examine written code by developers other than the author to identify errors, improve quality, and ensure adherence to coding standards. Reviews are conducted manually or with automated tools, fostering knowledge sharing and catching security vulnerabilities or bugs before they are deployed.
Secure coding practices are guidelines and techniques developers follow to write code that is robust against vulnerabilities. Practices include input validation, output encoding, using prepared statements in SQL queries, and handling errors securely. Adhering to secure coding standards helps protect against common threats like injection attacks, cross-site scripting, and data breaches.
Dependency checking involves analyzing a project's libraries and components to identify outdated or vulnerable versions that may pose security risks. Automated tools scan through dependencies declared in project files, comparing them against databases of known vulnerabilities. Developers are alerted to update or replace insecure components, thereby mitigating potential attack vectors.
Penetration testing is a simulated cyber attack against a system to check for exploitable vulnerabilities. Security professionals, known as ethical hackers, use manual or automated techniques to probe networks, applications, and other systems, attempting to breach security defenses. The findings help organizations understand their security posture and prioritize remediation efforts.
Code signing verifies the authenticity of software by allowing developers to sign their code digitally. It uses cryptographic techniques to assure end users that the code has not been tampered with and is from a trusted source. This process is vital for maintaining the integrity of distributed software and is especially important for preventing the spread of malware.
Security Assertions Markup Language (SAML) is an open standard for exchanging authentication and authorization data between parties, specifically between an identity provider and a service provider. It enables single sign-on (SSO), allowing users to log in once and access multiple applications securely without re-authenticating. SAML simplifies cross-domain web-based applications by using XML-based identity assertions to communicate user credentials.
OAuth is an open standard for access delegation commonly used as a way for Internet users to grant websites or applications access to their information on other websites but without giving them the passwords. In code security, OAuth allows for secure designated access, providing tokens instead of user credentials to authorize access to specific resources for third-party services without exposing user passwords.
The Open Web Application Security Project (OWASP) is a nonprofit foundation working to improve the security of software. It provides impartial, practical, actionable information and tools to enhance software security. OWASP is well-known for its top ten list of the most critical web application security risks, which is widely regarded as the standard guideline for web application security.
Container security is crucial because containers, by design, share the host system's kernel and, if not properly isolated, can expose the host and other containers to risks. Strong container security practices protect the containerized applications and their runtime environment from unauthorized access and vulnerabilities, which is paramount as containers are increasingly used to package and deploy applications in cloud environments.
Threat modeling identifies potential threats to a system and evaluates the risks they pose. It is a structured approach that guides security professionals in identifying and prioritizing potential threats and creating countermeasures to prevent or mitigate the effects of these threats. Threat modeling is an essential step in the design phase of a system's security architecture.
Encryption is used in code security to protect sensitive data from unauthorized access or exposure. Developers implement encryption algorithms to encode data, rendering it unintelligible without the corresponding decryption key. This practice is vital in securing data both at rest and during transmission, ensuring that even if data is intercepted, it remains confidential and secure.
In code security, authentication verifies the identity of users or entities before granting access to software systems. Developers implement authentication mechanisms such as passwords, tokens, or biometrics to ensure that only legitimate users can perform actions within an application. Effective authentication is a cornerstone of secure coding, preventing unauthorized access and protecting system integrity.
Authorization in code security involves granting or denying rights to resources within an application based on an authenticated entity's permissions. After authentication, the system checks the user's privileges to determine access levels to files, data, and functionality. Developers enforce authorization through access control lists, role-based access control (RBAC), or attribute-based access control (ABAC), ensuring users can only interact with resources they're cleared to use.
Patch management is the process of distributing and applying updates to software. These patches may include security fixes, new features, or improvements. Effective patch management involves regularly assessing systems for vulnerabilities, prioritizing patching based on risk, and ensuring timely application of patches across all affected systems. This practice is critical for mitigating the risk of security breaches and maintaining operational integrity.

Related content

Get the latest news, invites to events, and threat alerts