The Nooks and Crannies of AppSec

### Overview In this Source Zero Con 2023 presentation, John Cengaris explores the overlooked "nooks and crannies" of application security (AppSec) programs—elements that are often the last to be identified or entirely neglected, even in mature organizations. He argues that AppSec must be reframed from a narrow focus on code-level security controls into an overarching application development risk management paradigm. By viewing AppSec through a risk management lens, organizations can expand their visibility beyond traditional boundaries, uncover hidden liabilities, and align their security investments with business impact.

### Key Topics - **Reframing Security to Risk Management:** Moving past direct code-level controls to broader risk-mitigation strategies (transfer, avoid, reduce, accept). - **Secure Software Supply Chain Management in Depth:** Going beyond standard Software Bill of Materials (SBOM) and Software Composition Analysis (SCA) to incorporate legal and contractual controls, such as Service Level Agreements (SLAs) and multi-tiered attestation requirements with third-party vendors. - **Program Telemetry:** Structuring AppSec metrics across organizational levels (engineers, directors, executives) to evaluate ROI, trend shifts, and control efficacy rather than solely tracking raw vulnerability counts. - **Application Risk Profiles & Control Allocation:** Calculating risk profiles during onboarding to assign testing and training resources proportionally, avoiding budget exhaustion on low-criticality assets. - **Asset End-of-Life Planning:** Establishing structured decommissioning playbooks, reverse migration checklists, and archiving strategies to ensure legacy applications and dormant data do not create unmonitored security or compliance risks.

### Technical Details - **Supply Chain Legal Controls:** While tools like SBOM and SCA detect direct and transitive vulnerable libraries, contractual mechanisms provide non-code mitigation. Organizations can mandate SLAs that require vendors to patch critical vulnerabilities within specified timeframes (e.g., five days). However, in nested dependencies (where vendor X relies on vendor Y), standard contract clauses may fail unless contracts specifically require vendors to enforce attestations and SLAs down their own supply chains. - **Multi-Level Telemetry:** - *Engineering Level:* Day-to-day metrics such as application vulnerability counts and trend changes following the introduction of tools like SAST. - *Director Level:* Program-level KPIs evaluating budgetary commitments against the efficacy of people, processes, and tools (e.g., verifying whether tool implementations produce spikes in true positives). - *Executive Level:* High-level risk posture and ROI indicators, such as remediation rates and Mean Time to Remediate (MTTR) before vulnerabilities reach production. - **Risk-Profiled Resource Allocation:** Contrasting low-risk assets (e.g., an internal, read-only cafeteria menu web app assigned risk level 1) with high-risk assets (e.g., an app managing nuclear codes assigned risk level 5). Low-risk apps receive focused, threshold-based controls (automated SAST, focused code reviews, or pen tests only on major changes), while high-risk apps receive comprehensive, recurring code reviews, threat modeling, and pen tests. - **Role-Based & Risk-Based Training:** Tailoring education by role (OWASP basics and AppSec components for directors; vulnerability triage and development lifecycle integration for project managers) and by application risk (requiring threat modeling and secure coding courses specifically for engineers building high-risk systems). - **Decommissioning & Archival Architecture:** Addressing flawed end-of-life practices—such as merely closing external firewall ports (80/443) or shutting down a web server while leaving unmonitored servers running internally with hardcoded credentials. Implementing a reverse "migration to production checklist" that accounts for route tearing, server deprovisioning, database handling, and ensuring long-term data retention mandates account for the ability to decrypt and parse proprietary data formats years later.

### Takeaways - AppSec is fundamentally a function of risk management; approaching it as an "application risk management program" uncovers non-technical solutions such as legal vendor terms. - Uniform application of security controls exhausts resources quickly—as illustrated by a client spending an entire annual million-dollar pen-testing budget in three months by testing every release indiscriminately. - Application onboarding into an Application Portfolio Management system must include RACI matrices for both active operations and eventual decommissioning. - End-of-life plans should be treated with the same preparation and rigor as incident response playbooks to avoid leaving vulnerable, orphaned components across internal networks.