Future of Application Security

In this episode, Harshil is joined by Naomi Buckwalter, Director of Product Security at Contrast Security. Contrast Security is an application security platform that helps developers and security teams write secure code and protects business applications against targeted cybersecurity attacks. The Contrast platform is able to effectively identify actual vulnerabilities from false positives, resulting in faster remediation.

With more than two decades of experience in IT and Security, Naomi shares some tips on how to run a product security program, how to build a diverse team, and how to refine the hiring process to empower managers to choose the right candidates.

Topics discussed:

• How Naomi came to lead the product security team at Contrast Security

Technology has been growing by leaps and bounds but most supply chain processes for shipping, storing, and trading goods have remained fragmented. Flexport is the first to connect the entire ecosystem of global trade, empowering buyers, sellers and logistics providers to grow and innovate. Flexport’s platform sets a new standard for global trade by simplifying supply chain management.

In this episode, we are joined by Kevin Paige, CISO at Flexport. Kevin utilizes his two decade long work experience in IT and security to help the company streamline and optimize business processes, mitigate risks, and accelerate growth by aligning IT initiatives with broader company goals. 

Topics discussed:

• Kevin’s work background and how he shifted from being in the military handling physical security, working as a security consultant for the government,  to his current role at Flexport

Unqork is a no-code application platform that helps large enterprises rapidly build complex custom software by completely removing the usual development challenges of a traditional code-based approach.

In this episode, Harshil chats with Unqork’s Chief Information Security Officer, Daniel Wood, to learn more about how he’s helped build and scale the company’s product security program.

Daniel has more than a decade of experience in cybersecurity having worked as an information security analyst, and lead security engineer in previous roles.

Topics discussed:

• Daniel’s career journey and his transition from risk-based security work, to technical security engineering, consultancy, and corporate security work

Those in IT, DevOps, and SecOps are all too familiar with the demands of a complex and dynamic technological landscape. For more than two decades, SolarWinds has helped technology professionals and organizations manage and adapt to an ever-expanding ecosystem of IT applications and infrastructure. 

In this episode, Tim Brown, Vice President of Security at SolarWinds, gives us an insider view of the 2020 cyberattack where hackers slipped malicious code into the company's popular network management system and software program, Orion.  He shares how his team worked tirelessly to resolve the breach, and how this incident  has brought light to the software supply chain security issue and has helped strengthen the whole security industry. 

Topics discussed:

• Tim’s perspective on the dependence of security maturity on engineering process or development process maturity 

Links:

SolarWinds hack explained: Everything you need to know

SolarWinds breach: Lessons Learned & Practical steps

Chime, one of the fastest growing players in the financial technology space, has a mission of providing financial stability for their customers by eliminating many of the issues that come with traditional banking.

In today’s episode, Mukund Sarma, Director of Product Security at Chime, shares how he helps his team address the challenges in building security programs, and maintaining a solid and proactive security culture within the company.

Topics discussed:

• How Mukund got started in cybersecurity.

Pegasystems’ Pega Platform is a powerful low-code platform for AI-powered decisioning and workflow automation. The platform makes it easier for enterprises to work smarter, unify experiences, and quickly adapt. As a publicly traded company with a multi-billion dollar market cap,  more than 6,000 employees, and a global customer base, security is critical to the success of the company. 

In this episode of the Future of Application Security podcast, Harshil speaks to Pegasystems’ Director of Application Security, Tejpal Garhwal to learn about how Pega approaches AppSec. With a strong software development background and deep expertise in Application Security, Tejpal has spent his career managing multiple security and dev teams and setting the direction for information security application architecture, policy and processes within the organization.

Topics discussed:

• Tejpal's career transition from Software Development to Application Security

FullStory’s mission is to equip organizations with the information they need to deliver perfect digital experiences. To deliver on that mission, their platform captures customer experience data based on understanding browser interactions. In order to capture that data, it must have a position on the end user’s browser which requires a high level of customer trust. 

To ensure its service is delivered securely and that trust is maintained, the company has devoted significant resources to developing a robust Product Security Program. 

On today’s episode of the Future of Application Security, Harshil speaks with FullStory’s VP of Product Security and Compliance, Mark Stanislav to learn more about how the company has approached building and scaling its Product Security Program. 

Topics Discussed: 

• How Mark defines Product Security.

The pace of software development has increased dramatically over the past ten years and the traditional approach to application security has struggled to keep up. With modern development going from code to cloud within hours, manual security checks and  code reviews run the risk of slowing down releases and creating more tension between developers and security teams. 

To reduce this friction, organizations are shifting from the traditional application security approach to a more modern approach where security policies and controls are embedded in developer workflows. 

To learn more about this shift, in today’s episode of the Future of Application Security, Harshil speaks to Daniel Harvey, an industry veteran with more than 13 years in AppSec. Most recently, Daniel was the Director of Product Security at InVision. Prior to InVision, Daniel worked on AppSec teams at organizations including Clayton Homes, Citi, Elavon, and Discovery. 

Topics Discussed: 

• Daniel’s shift from application security to product security 

Stripe is the most valuable private startup in the United States with a market valuation of more than $95 billion. With more than 2 million customers spread across 46 countries and nearly 10,000 employees, the scale of Stripe is hard to fathom. To retain its position as the market leader, Stripe must continue to rapidly ship new products while at the same time ensuring those products are secure. 

To learn more about how Stripe has scaled their AppSec Program to keep up with the pace of development, in today’s episode, Harshil speaks with Stripe's Application Security Manager, Rajat Bhargav. Prior to joining Stripe in 2021, Rajat worked as a software engineer at Citi and Monsanto before transitioning to security where he has worked on AppSec teams at companies like eBay, Walmart, Netflix, and Twitter. 

Topics Discussed: 

• How to get developers engaged and interested in security (based on Rajat’s experience as a developer). 

Resources mentioned: 

Scaling Appsec at Netflix 

Locomocosec.com

Thirty Madison is a healthcare technology company that offers direct-to-consumer healthcare and wellness products for people living with chronic conditions. Founded in 2017, the company has raised over $200 million in funding and has more than 400 employees. 

As a healthcare company with millions of customers, Thirty Madison has the responsibility of holding their customers' most personal information. Keeping this highly sensitive data secure is mission critical to their business. A single breach could jeopardize their reputation and ruin their relationship with their customers. 

To ensure their customers and employees are secure, Thirty Madison brought on Anshuman Bhartiya to put in place a Product Security program that is capable of keeping up with the rapid growth of the company. In today’s episode, Anshuman joins Harshil to talk about the lessons learned as he built their Program Security program from scratch and the tactical advice he has for others who find themselves in a similar position. 

Topics:

• How to decide what problems and risks to prioritize when you are first building a product security program.