Climbing AppSec Mountains (and how to summit)

The talk opens with a fictional application security engineer, Ned, who is asked to build an internal appsec team at a large enterprise. His mandate covers securing existing and future code, shifting security earlier in development, and training developers. The speaker, who has worked on both development and appsec sides at large companies, uses Ned's situation to walk through the obstacles that pile up: aging scanners and firewalls, alert fatigue, acquisitions that bring in weak software, application portfolios running into the hundreds or thousands, and fast-changing languages and frameworks.

The middle section turns to fixes. The speaker suggests pairing interactive testing and runtime protection with a narrower, blocking-mode web firewall, so feedback arrives faster and with fewer false alarms. Appsec can also join acquisition reviews by putting the cost of inherited flaws into numbers. For new technology, an acceptable use policy reviewed by an architecture board lets teams innovate while still meeting standards. Workplace churn is handled with burn lists, sweeps for default and test credentials, and remote secure coding training that developers complete before touching code, backed by prebuilt secure templates.

The closing part addresses inflexible developers. The speaker argues that appsec should sit outside engineering, build real working relationships through shared meals, games, capture-the-flag contests and hackathons, and treat developers as partners rather than opponents. The Q&A touches on false positives from development-only dependencies and on supply chain exposure, with the advice that appsec staff understand enough code to challenge findings credibly.