Future of Application Security

The resounding sentiment from organizations is that there’s major tension between development and security teams. This tension makes it nearly impossible for any AppSec program to scale, making reducing this friction mission critical. 

To learn how to improve the relationship between developers and security, on today’s episode of the Future of AppSec Harshil speaks with Dustin Lehr, Director of Application Security at Fivetran, a Forbes Cloud 100 company that helps companies improve the accuracy of data-driven decisions by continuously synchronizing data from source applications to any destination, allowing analysts to work with the freshest possible data. 

Dustin is an accomplished software engineer turned information security leader. Having spent more than a decade as a software engineer, his diverse background and experience has helped him forge close partnerships with development teams, engineering teams, and software security advocates while pursuing the organizational culture shift of building good security habits into daily work. 

His approach focuses on communicating the importance of security, instilling a sense of urgency, and motivating the organization to shift their mindset toward “Security by Design” best practices, quality focus, and technical responsibility.

Topics:

• How Dustin’s background in software engineering influenced how he approached building Fivetrans AppSec program.  

Resources: 

Dustin’s “Let's Talk Software Security” Slack community: https://join.slack.com/t/letstalksoftw-64x2506/shared_invite/zt-t3e59aj9-5zNThhcrj4TCd4HJwAoDZA

Dustin’s current book recommendation: Actionable Gamification: Beyond Points, Badges, and Leaderboards

Harshil’s conference talk: Democratizing Security: A Story of Security Decentralization

Databricks is responsible for massive amounts of data for more than 7,000 customers worldwide including more than 40% of the Fortune 500. This means security is mission critical and the stakes are incredibly high. To keep their customer data secure, Databricks has put major focus into building both their product security team and strategy. In January, their team had just two members and today, there are 11 with many additional roles ready to be filled. 

To learn more about how Databricks approaches product security, Harshil speaks with the person leading the companies efforts —  Mrityunjay Gautam, Databricks Global Head of Product Security.

Topics discussed in the episode: 

• The difference between application security and product security. 

Resources mentioned: 

Technical books: https://nostarch.com/

Three years ago LinkedIn had no vulnerability management program in place. Today that’s a completely different story. Over the past three years, they built their program from scratch and rapidly scaled to keep their 25k+ employees and  800 million users safe and secure. 

How did LinkedIn achieve this scale so quickly and what lessons were learned along the way? On today’s episode we speak with Justin Anderson — LinkedIn’s Head of Vulnerability Management who was tasked with building out the company’s  program. Justin’s experience spans the US Air Force and MITRE offers a unique perspective on what it takes to overcome the challenges of scaling a security program. 

Topics discussed in this episode:

• What Justin and his team prioritized as they began building LinkedIn’s vulnerability management program.

Credit Karma is expanding rapidly and a huge focus for them is having a truly agile engineering team. Application security has also been a focus and their ratio of appsec engineers to developers is 1-:50 which is one of the industries best ratios. 

In their movement to success, today's show shares exactly how Credit Karma’s Director of Application Security Chaitanya Bhatt has tackled modern application security. Chaitanya’s perspectives and expertise come from his first-hand experience in leading security teams at organizations including eBay, AppDynamics (acquired by Cisco), and Autodesk. 

Key Findings: 

• How enforcing security policies earlier in the software development lifecycle can make security easier for developers. 

Resources: Episode mentioned — Travis McPeak: Securing the Modern SDLC with Security

This modern SDLC has really exacerbated the fractured relationship between developers and security. Often security is frustrated that developers cannot deliver on their laundry list of asks, and in turn, developers are sick of the legacy application security ways that slow down progress.

To scale at the speed of DevOps, organizations have to eliminate this friction and improve the relationship between developers and security.

Our guest today is Allan Swanepoel and during this episode, he’ll teach us exactly how we can do that by bringing the power of automation to your application security program. Allan has a deep understanding of both sides of this issue — for many years he was on the development side before moving over to security after observing the lack of automation that existed in security workflows and processes.

Topics discussed in this episode:

• Why organizations need to embrace a policy-driven prioritization approach to managing security.

Additional resources:

Lessons from integrating third party library scanning in DevOps workflow - AppSecUSA 2018 (Keynote that Harshil referenced in the episode).

Developers today go from code-to-cloud in a matter of hours and security teams are struggling to keep up. Legacy AppSec systems and processes are impeding their efforts to scale their AppSec program and the majority of security teams feel unprepared to govern and secure the modern SDLC. 

To solve this problem, organizations must rethink their approach to AppSec. Instead of trying to force developers to learn another skill set (security), adopt new tools or slow down development, AppSec teams must focus on security policies in developer workflows. Our guest today will teach us exactly how to make that happen. 

Travis McPeak is the co-founder and CEO of Resourcely.io which he founded after more than a decade of experience in cybersecurity, working at organizations including Netflix, IBM, and Symantec. In addition to his work as a practitioner, Travis is an active startup advisor and an angel investor, backing startups including Authzed, DevZero, Monad, Truffle Security, and more. 

Topics discussed in this episode:

• How to make security easy for developers and the tangible benefits organizations see when they are able to do so. 

To build a high-performing security team, organizations must rethink how they approach recruiting, hiring, and retaining talent. The problem is, building a great team is incredibly challenging today. With an estimated 400,000 unfilled security jobs, security teams are understaffed, burnt out, and struggling to keep up with an ever-increasing number of cyberattacks each day.  Our guest today teaches us exactly what security leaders can do to overcome these challenges and build a high-performing security team. Caleb Sima is the Chief Security Officer at Robinhood. He’s spent more than 20 years in cyber security following the unconventional path of spending his early years as a founder before transitioning over to the operations side and leading security teams at organizations including Databricks, HP, and Capital One. This unique journey provides Caleb with a unique and interesting perspective that every security leader can learn from. 

Topics Discussed: 

• What incentivized Caleb to transition from a company founder to an operations leader — making the translation from an “arms dealer to a soldier on the battlefield”. 

Most people think about threat modeling as an extensive, costly and heavyweight exercise. But what if it didn’t have to be? What if threat modeling could be as easy as asking and answering a few simple questions? 

In today’s episode, we speak with Adam Shostack about his simple four-question threat modeling framework. Adam’s framework was developed based on 20+ years of threat modeling experience ranging from startups to more than a decade at Microsoft. He believes deeply that organizations must rethink their approach to threat modeling. In this episode, Adam walks through his framework and teaches us how we should all be approaching threat modeling. 

Topics discussed in this episode:

• Why threat modeling shouldn’t only be for organizations with large teams of application security engineers. 

Resources Mentioned: 

Shostack white paper — Fast, Cheap, and Good  

Shostack 1 minute educational clips on Youtube  

Showstack threat modeling resource 

CISOs have one of the most unique views of an organization. 

Being in charge of teams that are under enormous pressure to ship, deliver, and sell security goes beyond an effective management.  

Michael Piacente is the co-founder and managing director of Hitch Partners and he has been helping the CISO community for several years. 

In today's show, he shares his insights about the patterns that most successful CISOs have in common.

Topics discussed in this episode:

• The attributes and skill sets of a great CISO.

In this first episode, NextRoll’s Product Security Lead Nicolas Valcarcel shares how since he was 15 he wanted to work in security. However, his career path has been far from conventional. 

By being part of developer teams in early-stage startups and working hand to hand with founding teams, he has been able to get a grasp on how developers and security teams see the same product in very different ways, and the common friction points that come from their interactions.

In this episode, Nico shared his experience and taught us his secret sauce: Advocating for engineering in the security team and advocating for security in the engineering team.

Topics discussed in this episode:

• Nico's background and how he landed in the application security field.