Legacy Apps: The Security Risk Lurking in Dusty Corners

A successful DevOps transformation empowers teams to release applications and add value for their organization faster than ever before. And now, with DevSecOps emphasizing early, integrated testing, security is being built into that high-velocity process. It's a tremendous improvement over past approaches in which security was tacked on to the very end of the development pipeline.

Still, many enterprises, even those with mature DevSecOps processes, tend to overlook a significant risk in their application portfolio: legacy apps that predate these improved processes. These application inventories include apps that may not have had a code change in years — and certainly weren't built using the best modern DevSecOps processes. Attackers know this and are happy to exploit it. A neglected segment of an organization's technology stack that is no longer monitored or cared for could be an attacker's ideal point of ingress.

These apps, lurking in dusty corners, might be used daily and no longer be under active development. Or they might be used infrequently, in forgotten production environments. Either way, they represent real risk for the business. The good news is that smart security teams that follow the four best practices below can mitigate the threats of legacy app-related security incidents.

Best Practice 1: Address "Tech Debt" Regularly and Incrementally
There's no escaping the fact that updating, monitoring, and maintaining legacy apps takes time, and, much like a sink full of dishes or a pile of dirty laundry, these tasks only become more time-consuming the longer they are put off. Rather than letting this "tech debt" become too daunting, it's worth considering dedicating a portion of the development team's time to reducing their maintenance efforts. This could involve the creation of a dedicated sprint team that takes turns owning this initiative or a by focusing a small percentage of each team's bandwidth on securing legacy apps and code on a regular basis.

Best Practice 2: Leverage Standards and Compliance Requirements
Associations like the National Institute of Standards and Technology (NIST) establish security guidelines and regulations specifically to help organizations achieve sound security postures. Cross-referencing legacy code against industry-approved frameworks can be a good method for identifying security flaws, making the security audit process a much less daunting task.

Best Practice 3: Maintain an Accurate Application Inventory
A critical step in addressing legacy app-related risk is establishing what apps are running on the corporate infrastructure. Start by creating a single catalog of applications and dependencies running in the corporate environment — including third-party apps and components. List each application's name, technology stack, purpose, users, and who in the organization may have firsthand knowledge of its implementation. This can be an arduous task, but if businesses employ policies to keep the inventory current after the initial lift, it's worth it.

Best Practice 4: Security Policies for Removing Legacy Apps
As organizations grow, workflows shift, and different team members become reliant on different applications. To deal with this constant state of change, IT and security teams need to implement a plan and process for reviewing the technology stack and sunsetting applications that no longer serve a business function. If the business is not getting anything out of an internal or third-party application, it is simply a potential source of risk with no corresponding reward.

A comprehensive security strategy must be just that: comprehensive. Modern businesses must account for every segment of the technology stack, not just those components being actively developed today. By following these guidelines, organizations will better understand the potential risk that legacy apps pose, and how to protect themselves from these risks before they become problematic.

Related Content:

 Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.