AppSecEU 16 - David Rook - Leveling up your application security program

### Overview In this AppSecEU 2016 presentation, David Rook, Senior Security Engineer at Riot Games, outlines how Riot built and leveled up its global application security (AppSec) program. Reflecting on Riot's culture as the developer of League of Legends, Rook emphasizes moving away from rigid, top-down compliance mandates common in financial services. Instead, the security team acts as an enabling "support champion" for developers, building trust, leveraging vulnerability metrics, operating a proactive bug bounty program, and creating developer-friendly automation to scale security across tens of millions of players.

### Key Topics - **Culture & The "Support Champion" Mentality**: Riot's AppSec mission is to equip engineers with the knowledge and tools needed to ship secure experiences rather than policing or blocking them. Framing AppSec as a gaming "support champion" helps developers view security as a partner that enables autonomy. - **Tailored Enablement Over Traditional Training**: Traditional multi-day classroom training failed to engage game developers. AppSec shifted to concise "Definition of Done" desk cards and internal developer portals (`appsec-design` for checklist-driven design reviews and `secure-coding.riotgames.com` for language-specific code snippets and recommended libraries). - **Security Champions & Recognition**: Teams nominate or organically develop security champions who receive extra security team mentorship, early access to tools, conference tickets (such as AppSec California), travel opportunities to present work, and rare, custom-designed champion t-shirts. - **Data-Driven AppSec & Bug Bounty**: Originating from a 2012 breach and early efforts to curb game cheating, Riot launched a public bug bounty on HackerOne in late 2014. Treating submissions as learning opportunities revealed that cross-site scripting (XSS) constituted ~40% of all vulnerabilities, directly directing the team's automation focus.

### Technical Details - **Centralized Vulnerability Tracking**: All vulnerabilities across the organization (AWS misconfigurations, game client RCEs, SQLi, XSS) are tracked and tagged in a central JIRA project to generate Riot-specific vulnerability trends. - **Automated Bug Bounty Verification**: To reduce the triage burden of reflected XSS, Rook built an initial 40-line proof-of-concept using PhantomJS and CasperJS, later expanded during Riot's "Thunderdome" hackathon using Selenium WebDriver (Java). The automated pipeline pulls XSS submission URLs from HackerOne, checks for expected alert popup values (e.g., `document.domain`, `document.cookie`), and comments directly back on HackerOne tickets within ~20 seconds. - **Static Analysis & Tooling Integration**: In response to engineer requests, the team codified JavaScript security guidelines into custom ESLint rules and extended them via a Burp Suite plugin for dynamic testers. - **GitHub Scanning & Slackbot**: Riot implemented a daily scanner leveraging the GitHub API across 12,000+ internal repositories to scan recent JavaScript commits with ESLint rules. A complementary Slackbot detects newly created repositories, identifies frameworks like Node.js, alerts developers with helpful guidance, checks `package.json` for vulnerable npm packages (integrating Node Security Project concepts), and offers one-click buttons to opt into automated security scanning.

### Takeaways - Align AppSec initiatives with organizational culture; avoid forcing frameworks like Microsoft SDL where they do not fit. - Use real vulnerability data from bug bounties and centralized tracking to prioritize security automation and training. - Reward and empower security champions with genuine appreciation, resources, and recognition to scale security across diverse engineering teams.