From Chaos to Clarity: Designing AppSec from First Principles

The talk opens with why application security programs feel chaotic. A flood of acronyms, vendor promises of silver bullets, and overlapping compliance checklists make it hard to decide what to do next. The speaker, a product security lead at a data and analytics software company, proposes building on a few working principles: question how time is spent, look at security work from the developer's side, and favor fast feedback, automation and added context over handing developers growing piles of findings.

The middle section compares frameworks and maturity models, including ISO 27001, SAMM, BSIMM, ASVS and the Zero Trust maturity model. The speaker settles on DSOMM because it is prescriptive about CI/CD and DevOps practices. Experiences from the speaker's organization cover pipeline security gates, automated dependency updates, trunk-based development, and the cost of deferring tests or code review. A live demo of the DSOMM tool shows how to filter by maturity level, follow dependency trees, and map controls to ISO 27001 and other standards through OpenCRE.

The closing part offers a starter approach: assess context and resources, set target maturity levels, work through the model as a progression, make progress visible to teams, and iterate in short cycles. The main takeaway is that good-enough controls, built into developer workflows and automated where possible, are more useful than a perfect plan that never ships.