Constructing a Secure AppSec Foundation with CommunityAmerica Credit Union & StackHawk

### Overview In this webinar, Lake Setzer (Information Security Lead at CommunityAmerica Credit Union) and Scott Gerlock (CSO and Co-founder at StackHawk), hosted by Alexa Sevilla, discuss the transformation of CommunityAmerica's Application Security (AppSec) program. In early 2021, CommunityAmerica made a strategic pivot from purchasing third-party applications to developing in-house software, prompting the rapid creation of an internal AppSec program. Initially, the program adopted traditional, centralized tooling that failed due to misaligned licensing models, slow external scanners, and an inability to handle modern microservice architectures and specific frameworks like Micronaut for Java. The discussion chronicles how Lake shifted his approach from centralized control to developer enablement and cross-functional partnership, adopting modern SAST, SCA, and DAST tooling integrated directly into CI/CD pipelines.

### Key Topics - **Initial AppSec Failures and Lessons Learned**: Early tooling relied on legacy point-and-click scanning and per-application pricing models that proved unsustainable for hundreds of microservice repositories. Scanners suffered from pipeline delays and failed to analyze Micronaut frameworks. - **AppSec Shift-Left Maturity Model**: Evaluating an organization's maturity from stage 1 (centralized control, audit-driven scanning) toward stages 3 and 4 (shared ownership, developer-driven scanning, and automated proactive gates). - **Developer & Cross-Team Partnership**: Aligning with key engineering teams—specifically the Enterprise Integration Platforms (EIP) team, the digital frontend team, and devops—by actively listening, accommodating their workflows, and eliminating development bottlenecks. - **Tooling Selection & Architecture**: Evaluating tools based on framework compatibility, simultaneous scanning, developer-focused licensing, and fast execution inside CI/CD pipelines. - **Business Alignment & Risk Defense**: Framing AppSec not merely around vulnerability tallies, but around brand reputation, member trust, and core organizational assets.

### Technical Details CommunityAmerica supports approximately 50 developers across five major teams working within a polyrepo environment containing hundreds of microservices. To support their architecture, the AppSec tooling stack was revamped: - **SAST & Code Quality**: SonarQube was selected to provide static analysis, enforce code formatting guidelines (such as PEP 8 guidelines for Python), and detect standard security issues. - **SCA**: Snyk was integrated to manage software composition analysis and open-source dependency vulnerabilities, compensating for framework-specific limitations and lack of native SCA in SonarQube. - **DAST**: StackHawk was chosen for dynamic API and application security testing. Key requirements included rapid scan times (regularly completing under two minutes or even under one minute), unlimited scans across environments (development, testing, and production) without extra licensing penalties, and the ability to run directly inside CI/CD pipelines and local developer environments. - **Pipeline Integration**: Scans trigger automatically on build and pull request events using Jenkins and Azure Repos. Scan results decorate pull requests directly, giving developers immediate feedback on passes or failures. - **Policy & Gates**: The team established automated triage criteria where high, critical, or urgent vulnerabilities (levels 3, 4, and 5 on a 5-point scale) require mandatory remediation, moving gradually from soft gates to hard build/PR blocking gates.

### Takeaways - **Ditch Centralized Control**: AppSec teams cannot act as the sole bottleneck; success requires stepping back from centralized control and co-owning security with developers. - **Listen and Solve Engineering Problems**: Security professionals must actively consult engineering and devops teams, understand their operational hurdles, and provide tooling that speeds up development rather than stopping releases at the last minute. - **Target High-Impact Teams First**: Rather than attempting a sweeping organization-wide rollout, partner first with high-code-volume teams (such as platform/EIP teams) to test, iterate, and build a reusable model for other groups. - **Automate to Eliminate Noise**: Automation in triage and pipeline feedback reduces manual handoffs and prevents vulnerability backlogs from ballooning, turning security findings into incremental, lint-like fixes.