What is ASPM?

Written by LingRaj Patil, VP of Marketing, ArmorCode.

Application Security Posture Management (ASPM) is a long name for an approach centered around unlocking AppSec visibility across the Continuous Development and Continuous Deployment pipeline. If you are with a software development organization that’s seeking to gain visibility into your AppSec assets and security posture, then this one’s for you

Businesses typically come across Application Security Posture Management due to security incidents, an audit that’s uncovered holes or inefficiencies, or a recognition that they have limited understanding of what applications are deployed and their respective security posture across their environment. Once you’ve identified that ASPM might be a solution to your business needs it’s time to go into the information-gathering phase. Let’s help you out with the basics of ASPM.

What is ASPM in a nutshell?

ASPM, or Application Security Posture Management, is an integrated solution designed to deliver application security visibility throughout the application lifecycle from development to production.

• Identification and mapping of software assets and their interdependencies
• Unification and correlation of security data to provide deeper security insights
• Views of application security posture, from drill-down to singular assets to zoom out across the enterprise

Is ASPM DevOps friendly?

Moving to Agile was a kick to AppSec. Now tools and processes that ran at specific times in an application’s lifecycle had to somehow fit into a very different style of work delivery - and we’ve been struggling ever since.

Ultimately, ASPM is AppSec catching up to the crowd. It’s about understanding and assessing application security posture across and within the Continuous Integration / Continuous Development pipeline, rather than as a bolt-on addition.

Is Application Security Posture Management new?

If you’re wondering why you haven’t heard of Application Security Posture Management before, don’t be alarmed. As you’d be used to in the tech industry, it’s a new term that’s only been around for a couple of years - it’s far younger than terms like DevSecOps or Shift Left.

But like many cutting-edge security concepts and solutions, it’s something that we believe will be widespread in the industry before too long.

While standalone tools and processes that give visibility into a single layer have been around for some time, holistic solutions to deliver end-to-end application security visibility in the cloud are a newer beast. As the complexity for cloud applications grows, discovering your assets and getting security visibility across the development pipeline only becomes more important.

How does ASPM fit into DevSecOps?

Application Security becomes embedded in the DevSecOps pipeline when you can deliver visibility, automation, and collaboration with developers across the entire SSDLC. By using ASPM, security teams, operations, and developers can all get on the same page as far as what application assets are in the cloud environment and what their security posture is, removing friction in miscommunications caused by teams living in silos and team-specific tools.

Collaboration is a key component of DevOps, DevSecOps, and other multi-disciplinary teams. True collaboration between these team members is either not possible or too time-consuming when data and information have awkward hand-offs along the pipeline. By introducing integrated solutions for visibility throughout the lifecycle, in AppSec, compliance, and other critical development tasks, team members all have a point of reference that is relevant to their specific needs and stakeholder interest, while being able to have a common understanding of others’ perspectives at the same time. This creates the foundation upon which automation, workflows, and remediation can be built, although these efforts move beyond the scope of pure ASPM tools.

What are the components of ASPM?

There are a range of different components that come together in an ASPM solution, depending on the project and organizational needs. These generally include:

• Asset inventory, including apps, third-party libraries, network connections, infrastructure, data, and more
• Detection and/or correlation of application security misconfigurations
• Policy management, for the holistic application of different security and compliance policies across the ecosystem
• Composability, to integrate new security tools into the system with relative ease
• Real-time monitoring, eliminating bottlenecks caused by point-in-time processes
• Reporting views, with different security overviews based on different system users

Do I need ASPM?

While it could be said that every organization that develops software would be wise to roll out ASPM, this simply isn’t practical or necessary for everyone. As a consensus, ASPM is recommended for:

• Organizations with a large number of cloud applications, particularly if each is fairly different from the next
• Organizations with a large number of clients with different AppSec requirements
• Larger development organizations
• Organizations that develop complex applications in the cloud, integrating a large number of third-party applications or resources
• Organizations seeking to future-proof their AppSec processes
• Organizations rolling out DevSecOps to the enterprise
• Organizations that are remote-first

Compliance-heavy industries and application developers

Within certain industries, there are strict compliance regulations and guidelines required to stay within the law and/or champion leadership in the space. These include finance, healthcare, government, resources, and mining, among others. Organizations operating within these industries or looking to target them in the future will enjoy a high ROI with the right ASPM solution.

How do I benchmark my organization’s Application Security Posture?

“Just because we've done testing like desk checks since the 1970s doesn't mean it's a good idea. Measure, evaluate, and then build or improve.” - OWASP Top 10

To test the viability of an ASPM solution, you’ll want to run a pilot project. But first, you’ll need to benchmark your current Application Security Posture. By defining the right metrics, you’ll have the right benchmarks to report on pilot success.

To benchmark, consider metrics like vulnerability density, mean time to remediation, and percentage of high-risk vulnerabilities fixed. Models that you can use for assessment include the OWASP Software Assurance Maturity Model and NIST Cybersecurity Framework. While it’s possible to do it internally, if you don’t have experience in conducting these audits then it can be valuable to outsource.