Application Security

Building Cyber Resilience: Application Security Navigation

Core Technical Domains in Application Security

• Secure Coding Practices & Vulnerability Prevention:
  • Input Validation & Injection Defense: Enforcing strict server-side type checking, parameterized SQL queries (prepared statements), and ORM abstraction to eliminate SQL, Command, and LDAP injection.
  • Cross-Site Scripting (XSS) & Request Forgery (CSRF): Context-aware output encoding/escaping, enforcing strict Content Security Policies (CSP), and utilizing SameSite=Strict cookies with anti-CSRF synchronizer tokens.
  • Insecure Direct Object References (IDOR): Validating user authorization context on every server-side data fetch rather than trusting client-supplied record keys or URL parameters.
• Secure SDLC & CI/CD Security Gates (DevSecOps):
  • Static Application Security Testing (SAST): Automated source code analysis (Semgrep, SonarQube) running inside pull requests to flag insecure functions and hardcoded credentials.
  • Software Composition Analysis (SCA) & SBOM: Scanning third-party dependencies for known vulnerabilities (Trivy, Snyk) and generating CycloneDX/SPDX Software Bill of Materials (SBOM) per build.
  • Secret Detection & IaC Scanning: Scanning repository history for leaked API keys (Gitleaks, TruffleHog) and auditing infrastructure configuration files (Checkov).
• API Security & Authorization Architectures:
  • Token Verification & Session Hygiene: Validating asymmetric JWT signatures (RS256), enforcing short-lived access tokens, and managing refresh token rotation inside HttpOnly/Secure cookies.
  • Fine-Grained Authorization: Applying Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC), or Relationship-Based Access Control (ReBAC / Zanzibar model) at the resolver layer.
  • Rate-Limiting & Idempotency: Rate-limiting public routes by IP/token and requiring unique Idempotency-Key headers on POST requests to prevent double-submit resource duplication.
• Runtime Protection & Supply Chain Integrity:
  • Runtime Application Self-Protection (RASP) & SSRF Guards: Wrapping outbound HTTP calls with strict IP/domain allowlists to block Server-Side Request Forgery (SSRF) targeting cloud IMDS endpoints (169.254.169.254).
  • Artifact Signing: Digitally signing container images and build artifacts (Sigstore Cosign) to enforce keyless OIDC verification at cluster admission.

Secure SDLC CI/CD Workflow Specification

# AppSec pipeline: SAST + Secrets + SCA/IaC + Container + (optional) DAST + SBOM
name: appsec-pipeline
on:
  pull_request:
  push:
    branches: [ main, master ]
env:
  TARGET_URL: ${{ vars.ZAP_TARGET_URL }}
permissions:
  contents: read
  security-events: write
jobs:
  appsec:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # --- SAST (Semgrep) ---
      - name: SAST – Semgrep (OWASP Top 10)
        uses: returntocorp/semgrep-action@v1
        with:
          config: p/owasp-top-ten
          generateSarif: true

      # --- Secrets (Gitleaks) ---
      - name: Secret scan – Gitleaks
        uses: gitleaks/gitleaks-action@v2
        with:
          args: "--redact --no-git"

      # --- SCA & IaC (Trivy) ---
      - name: SCA/IaC – Trivy (filesystem)
        uses: aquasecurity/[email protected]
        with:
          scan-type: 'fs'
          ignore-unfixed: true
          format: 'table'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'
          output: trivy-fs.txt

      # --- Container Scan (Trivy) ---
      - name: Container scan – Trivy (image)
        if: hashFiles('Dockerfile') != ''
        uses: aquasecurity/[email protected]
        with:
          image-ref: 'app:${{ github.sha }}'
          format: 'table'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'
          output: trivy-image.txt

      # --- SBOM (CycloneDX via Syft) ---
      - name: SBOM – CycloneDX (Syft)
        uses: anchore/syft-action@v0
        with:
          output: 'cyclonedx-json=sbom.cdx.json'