97 Things Every Application Security Professional Should Know

Chapter 33. Code Provenance for DevSecOps

Yashvier Kosaraju

The term provenance alludes to the original source or historical lineage of ownership. When approached from the realm of application security, the concept of code provenance or code ownership emerges as the foremost challenge that every AppSec team must confront before entering the captivating realm of DevSecOps automation and advanced tooling. This prelude is crucial, as it entails discerning the appropriate individuals to designate or alert when AppSec tools unearth vulnerabilities.

Picture this: you find a deadly SQLi (or pick your favorite bug), in a piece of code through the various practices in your AppSec program (internal code review, external security review, etc.). How do you go from here to figuring out if this code is deployed into production, which team owns it, who needs to fix it, and who it needs to be escalated to if the need arises? Now repeat this for every code bug you find in your code. You are going to spend the majority of your time finding owners rather than finding issues to fix or reviewing designs.

The solution to this is to figure out a way to have ownership information of code (and other systems) either in a separate system with APIs or by throwing a simple file into every code repo that has the information you need. Once you have this information, you can quickly go from a bug to alerting ...