Back in 2014, when Microsoft disbanded their Trustworthy
Computing Group responsible for setting the direction of Microsoft’s
cybersecurity efforts, the decision was met by confusion. The employees who didn’t get laid off were
split between the legal department and Cloud & Enterprise. How would the security efforts led by the
Trustworthy Computing group live on under new departments whose mission was not
solely focused on security? There are a
couple of competing views about this move and this is why AppSec is the
redheaded stepchild in the security industry.
Where does AppSec belong? Should
AppSec live in the infosec department or the software development department? Does anyone really want to own AppSec?
AppSec Belongs in Software Development
I am reminded of a quote from Dinis Cruz (@DinisCruz) from
his AppSecEU presentation. Dinis said “The
best way to determine if you have an AppSec program is to ask if those guys can
program. And the second question is
would the development teams hire them?
If your development teams would not hire the guys that currently do
AppSec then you don’t have AppSec.” This
quote really struck me. It’s brutally
honest. The role of the AppSec team
should be to work with the developers to write secure code. How can you help developers write secure code
if you have never developed code before?
It is not enough to tell developers to use parameterized queries to
prevent SQL injection. An AppSec
engineer should be able to show the developers how to implement parameterized
queries in the chosen language. For
example, in Java just using the PreparedStatement class is not enough to
prevent SQL injection even though some developers think it is. When interviewing a candidate for the AppSec
team you would have developers interviewing the candidate and quizzing them on
programming concepts. Not only should
the candidate be competent about these concepts but they should also have the
chemistry to fit in with the culture on the development teams. This can only be achieved by having
developers involved in the interview process.
Furthermore, senior management would have to account for AppSec
initiatives in their budget and scheduling.
This gives AppSec a bit more leverage when they propose new
initiatives. When AppSec is consuming
someone else’s budget there is less motivation for development teams to play
nice. Enough can’t be said about AppSec
sitting next to developers and being involved in side conversations and
whiteboard sessions that often happen when AppSec is on another floor.
AppSec Belongs in InfoSec
There’s a certain culture that security professionals
share. These professionals bond over
vulnerabilities, breaches, and security conferences. The job of AppSec often overlaps with GRC
(governance, risk management and compliance), TVM (threat and vulnerability
management), and Red Team. AppSec works
with GRC to develop security requirements to comply with regulations and help
GRC understand the risk of application vulnerabilities. TVM deals with breaches and this involves
pulling in AppSec to understand how a vulnerability was exploited in a
home-grown application. Red Team
performs pen tests and works with AppSec to develop fixes for vulnerabilities
that are found. Having all of these
teams sit in the same room provides many benefits that aren’t seen when AppSec
sits on a different floor. The CISO of
an organization is responsible for the overall security posture of the
organization which includes home-grown applications and thus drives AppSec
initiatives. Sitting in the SOC gives
AppSec a unique view into the current threats facing an organization. These threats are presented in real time and
gives team members a chance to respond immediately if needed. There are certain characteristics security
professionals possess and which are required that might not be obvious to
people outside of security. This gives
InfoSec the unique ability to identify candidates with the right security
mindset required for the job.
So what’s the answer?
Where should AppSec live? In a
perfect world, InfoSec and Development would share responsibility for the
AppSec team. During the interview
process, both departments should be involved in the process to avoid hiring a
candidate who is incompatible with either department. We don’t live in a perfect world so where the
team lives depends on the organization’s philosophy. For Microsoft, it made sense to move their
security team to the development side of the house. This would be my preference for where AppSec
lives, but that’s the developer in me talking.
I sit in the SOC with the InfoSec teams and there are times I miss being
involved in design discussions with developers.
