{"id":18,"date":"2022-09-30T23:28:05","date_gmt":"2022-10-01T04:28:05","guid":{"rendered":"https:\/\/waratek.com\/?page_id=18"},"modified":"2022-10-26T17:33:52","modified_gmt":"2022-10-26T22:33:52","slug":"chapter-2-security-as-code-basics","status":"publish","type":"page","link":"https:\/\/waratek.com\/security-as-code\/chapter-2-security-as-code-basics\/","title":{"rendered":"Chapter 2: Security-as-Code Basics"},"content":{"rendered":"

If we’re to use Infrastructure-as-Code<\/a> as a blueprint for Security-as-Code, there are three key pillars that any SaC solution needs to exemplify:<\/span><\/p>\n

1. Immutability<\/span><\/strong><\/h2>\n

The rules you define should remain accurate to prevent vulnerability regressions with each deployment. Security must be continuous to achieve immutability – not at a single instance like in the CI\/CD pipeline<\/a>.<\/span><\/p>\n

To perform security continuously, the protection applied to your applications and APIs must be inseparable. Due to this nuance, utilization of the runtime or VM is necessary.<\/span><\/p>\n

2. Scalability<\/span><\/h2>\n

Cost and human capital are the reasons current security solutions don’t scale. WAFs and RASPs, for example, are essentially massive data pipelines that ingest, analyze, and make assumptions on HTTP payloads to determine risk.<\/span><\/p>\n

This focus on HTTP payloads<\/a>, a lagging indicator, results in false positives and negatives, exasperating the scalability issues of existing Security solutions.<\/span><\/p>\n

Static analysis tools only do marginally better by telling you what code to fix. Then your teams are left with the manual task of patching the vulnerabilities.<\/span><\/p>\n

The only way to improve security scalability is to automate the process of patching code. Compilers have operated on this philosophy for decades to improve performance.<\/span><\/p>\n

The same philosophy can also correct known vulnerabilities and insert security rules that block unknown vulnerabilities (zero days). When you fix the vulnerable code, you eliminate false positives and negatives and the need for expensive hardware.<\/span><\/p>\n

This decreased friction enables security teams to, for the first time, scale with modern software development.<\/span><\/p>\n

3. Performance<\/span><\/h2>\n

In theory, an infallible security solution works, but we need to meet business demand in the real world. Because of that, most security solutions recommend running in sample mode, where only a handful of requests are protected.<\/span><\/p>\n

Companies shouldn’t have to choose between being protected and remaining competitive.<\/span><\/p>\n

Companies no longer have to make this choice when your security solution has proximity to the application and APIs through living in the runtime or VM and adopting the philosophies from compilers.<\/span><\/p>\n

Security-as-Code implementations average less than 2% performance impact on average at scale.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"There’s a lack of cohesiveness in the term Security-as-Code. Objectively learn the attributes and basics of real Security-as-Code platforms.","protected":false},"author":1,"featured_media":44,"parent":16,"menu_order":2,"comment_status":"closed","ping_status":"closed","template":"template-chapter.blade.php","meta":{"footnotes":"","_links_to":"","_links_to_target":""},"class_list":["post-18","page","type-page","status-publish","has-post-thumbnail","hentry"],"yoast_head":"\nChapter 2: Security-as-Code Basics | Waratek<\/title>\n<meta name=\"description\" content=\"There's a lack of cohesiveness in the term Security-as-Code. Objectively learn the attributes and basics of real Security-as-Code platforms.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/waratek.com\/security-as-code\/chapter-2-security-as-code-basics\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Chapter 2: Security-as-Code Basics | Waratek\" \/>\n<meta property=\"og:description\" content=\"There's a lack of cohesiveness in the term Security-as-Code. Objectively learn the attributes and basics of real Security-as-Code platforms.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/waratek.com\/security-as-code\/chapter-2-security-as-code-basics\/\" \/>\n<meta property=\"og:site_name\" content=\"Waratek\" \/>\n<meta property=\"article:modified_time\" content=\"2022-10-26T22:33:52+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/waratek.com\/wp-content\/uploads\/2022\/10\/chapter-2.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:site\" content=\"@waratek\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/waratek.com\/security-as-code\/chapter-2-security-as-code-basics\/\",\"url\":\"https:\/\/waratek.com\/security-as-code\/chapter-2-security-as-code-basics\/\",\"name\":\"Chapter 2: Security-as-Code Basics | Waratek\",\"isPartOf\":{\"@id\":\"https:\/\/waratek.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/waratek.com\/security-as-code\/chapter-2-security-as-code-basics\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/waratek.com\/security-as-code\/chapter-2-security-as-code-basics\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/waratek.com\/wp-content\/uploads\/2022\/10\/chapter-2.png\",\"datePublished\":\"2022-10-01T04:28:05+00:00\",\"dateModified\":\"2022-10-26T22:33:52+00:00\",\"description\":\"There's a lack of cohesiveness in the term Security-as-Code. Objectively learn the attributes and basics of real Security-as-Code platforms.\",\"breadcrumb\":{\"@id\":\"https:\/\/waratek.com\/security-as-code\/chapter-2-security-as-code-basics\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/waratek.com\/security-as-code\/chapter-2-security-as-code-basics\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/waratek.com\/security-as-code\/chapter-2-security-as-code-basics\/#primaryimage\",\"url\":\"https:\/\/waratek.com\/wp-content\/uploads\/2022\/10\/chapter-2.png\",\"contentUrl\":\"https:\/\/waratek.com\/wp-content\/uploads\/2022\/10\/chapter-2.png\",\"width\":1200,\"height\":630},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/waratek.com\/security-as-code\/chapter-2-security-as-code-basics\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/waratek.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security-as-Code: How to with Modern Development\",\"item\":\"https:\/\/waratek.com\/security-as-code\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Chapter 2: Security-as-Code Basics\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/waratek.com\/#website\",\"url\":\"https:\/\/waratek.com\/\",\"name\":\"Waratek\",\"description\":\"Just another WordPress site\",\"publisher\":{\"@id\":\"https:\/\/waratek.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/waratek.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/waratek.com\/#organization\",\"name\":\"Waratek\",\"url\":\"https:\/\/waratek.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/waratek.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/waratek.com\/wp-content\/uploads\/2022\/10\/logo-dark-small.png\",\"contentUrl\":\"https:\/\/waratek.com\/wp-content\/uploads\/2022\/10\/logo-dark-small.png\",\"width\":150,\"height\":31,\"caption\":\"Waratek\"},\"image\":{\"@id\":\"https:\/\/waratek.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/x.com\/waratek\",\"https:\/\/www.linkedin.com\/company\/waratek-ltd\"]}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Chapter 2: Security-as-Code Basics | Waratek","description":"There's a lack of cohesiveness in the term Security-as-Code. Objectively learn the attributes and basics of real Security-as-Code platforms.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/waratek.com\/security-as-code\/chapter-2-security-as-code-basics\/","og_locale":"en_US","og_type":"article","og_title":"Chapter 2: Security-as-Code Basics | Waratek","og_description":"There's a lack of cohesiveness in the term Security-as-Code. Objectively learn the attributes and basics of real Security-as-Code platforms.","og_url":"https:\/\/waratek.com\/security-as-code\/chapter-2-security-as-code-basics\/","og_site_name":"Waratek","article_modified_time":"2022-10-26T22:33:52+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/waratek.com\/wp-content\/uploads\/2022\/10\/chapter-2.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_site":"@waratek","twitter_misc":{"Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/waratek.com\/security-as-code\/chapter-2-security-as-code-basics\/","url":"https:\/\/waratek.com\/security-as-code\/chapter-2-security-as-code-basics\/","name":"Chapter 2: Security-as-Code Basics | Waratek","isPartOf":{"@id":"https:\/\/waratek.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/waratek.com\/security-as-code\/chapter-2-security-as-code-basics\/#primaryimage"},"image":{"@id":"https:\/\/waratek.com\/security-as-code\/chapter-2-security-as-code-basics\/#primaryimage"},"thumbnailUrl":"https:\/\/waratek.com\/wp-content\/uploads\/2022\/10\/chapter-2.png","datePublished":"2022-10-01T04:28:05+00:00","dateModified":"2022-10-26T22:33:52+00:00","description":"There's a lack of cohesiveness in the term Security-as-Code. Objectively learn the attributes and basics of real Security-as-Code platforms.","breadcrumb":{"@id":"https:\/\/waratek.com\/security-as-code\/chapter-2-security-as-code-basics\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/waratek.com\/security-as-code\/chapter-2-security-as-code-basics\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/waratek.com\/security-as-code\/chapter-2-security-as-code-basics\/#primaryimage","url":"https:\/\/waratek.com\/wp-content\/uploads\/2022\/10\/chapter-2.png","contentUrl":"https:\/\/waratek.com\/wp-content\/uploads\/2022\/10\/chapter-2.png","width":1200,"height":630},{"@type":"BreadcrumbList","@id":"https:\/\/waratek.com\/security-as-code\/chapter-2-security-as-code-basics\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/waratek.com\/"},{"@type":"ListItem","position":2,"name":"Security-as-Code: How to with Modern Development","item":"https:\/\/waratek.com\/security-as-code\/"},{"@type":"ListItem","position":3,"name":"Chapter 2: Security-as-Code Basics"}]},{"@type":"WebSite","@id":"https:\/\/waratek.com\/#website","url":"https:\/\/waratek.com\/","name":"Waratek","description":"Just another WordPress site","publisher":{"@id":"https:\/\/waratek.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/waratek.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/waratek.com\/#organization","name":"Waratek","url":"https:\/\/waratek.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/waratek.com\/#\/schema\/logo\/image\/","url":"https:\/\/waratek.com\/wp-content\/uploads\/2022\/10\/logo-dark-small.png","contentUrl":"https:\/\/waratek.com\/wp-content\/uploads\/2022\/10\/logo-dark-small.png","width":150,"height":31,"caption":"Waratek"},"image":{"@id":"https:\/\/waratek.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/waratek","https:\/\/www.linkedin.com\/company\/waratek-ltd"]}]}},"_links":{"self":[{"href":"https:\/\/waratek.com\/wp-json\/wp\/v2\/pages\/18","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/waratek.com\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/waratek.com\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/waratek.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/waratek.com\/wp-json\/wp\/v2\/comments?post=18"}],"version-history":[{"count":0,"href":"https:\/\/waratek.com\/wp-json\/wp\/v2\/pages\/18\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/waratek.com\/wp-json\/wp\/v2\/pages\/16"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/waratek.com\/wp-json\/wp\/v2\/media\/44"}],"wp:attachment":[{"href":"https:\/\/waratek.com\/wp-json\/wp\/v2\/media?parent=18"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}