AppSec: The Redheaded Stepchild

Back in 2014, when Microsoft disbanded their Trustworthy Computing Group responsible for setting the direction of Microsoft’s cybersecurity efforts, the decision was met by confusion.  The employees who didn’t get laid off were split between the legal department and Cloud & Enterprise.  How would the security efforts led by the Trustworthy Computing group live on under new departments whose mission was not solely focused on security?  There are a couple of competing views about this move and this is why AppSec is the redheaded stepchild in the security industry.  Where does AppSec belong?  Should AppSec live in the infosec department or the software development department?  Does anyone really want to own AppSec?

AppSec Belongs in Software Development

I am reminded of a quote from Dinis Cruz (@DinisCruz) from his AppSecEU presentation.  Dinis said “The best way to determine if you have an AppSec program is to ask if those guys can program.  And the second question is would the development teams hire them?  If your development teams would not hire the guys that currently do AppSec then you don’t have AppSec.”  This quote really struck me.  It’s brutally honest.  The role of the AppSec team should be to work with the developers to write secure code.  How can you help developers write secure code if you have never developed code before?  It is not enough to tell developers to use parameterized queries to prevent SQL injection.  An AppSec engineer should be able to show the developers how to implement parameterized queries in the chosen language.  For example, in Java just using the PreparedStatement class is not enough to prevent SQL injection even though some developers think it is.  When interviewing a candidate for the AppSec team you would have developers interviewing the candidate and quizzing them on programming concepts.  Not only should the candidate be competent about these concepts but they should also have the chemistry to fit in with the culture on the development teams.  This can only be achieved by having developers involved in the interview process.  Furthermore, senior management would have to account for AppSec initiatives in their budget and scheduling.  This gives AppSec a bit more leverage when they propose new initiatives.  When AppSec is consuming someone else’s budget there is less motivation for development teams to play nice.  Enough can’t be said about AppSec sitting next to developers and being involved in side conversations and whiteboard sessions that often happen when AppSec is on another floor.

AppSec Belongs in InfoSec

There’s a certain culture that security professionals share.  These professionals bond over vulnerabilities, breaches, and security conferences.  The job of AppSec often overlaps with GRC (governance, risk management and compliance), TVM (threat and vulnerability management), and Red Team.  AppSec works with GRC to develop security requirements to comply with regulations and help GRC understand the risk of application vulnerabilities.  TVM deals with breaches and this involves pulling in AppSec to understand how a vulnerability was exploited in a home-grown application.  Red Team performs pen tests and works with AppSec to develop fixes for vulnerabilities that are found.  Having all of these teams sit in the same room provides many benefits that aren’t seen when AppSec sits on a different floor.  The CISO of an organization is responsible for the overall security posture of the organization which includes home-grown applications and thus drives AppSec initiatives.  Sitting in the SOC gives AppSec a unique view into the current threats facing an organization.  These threats are presented in real time and gives team members a chance to respond immediately if needed.  There are certain characteristics security professionals possess and which are required that might not be obvious to people outside of security.  This gives InfoSec the unique ability to identify candidates with the right security mindset required for the job. 

So what’s the answer?  Where should AppSec live?  In a perfect world, InfoSec and Development would share responsibility for the AppSec team.  During the interview process, both departments should be involved in the process to avoid hiring a candidate who is incompatible with either department.  We don’t live in a perfect world so where the team lives depends on the organization’s philosophy.  For Microsoft, it made sense to move their security team to the development side of the house.  This would be my preference for where AppSec lives, but that’s the developer in me talking.  I sit in the SOC with the InfoSec teams and there are times I miss being involved in design discussions with developers.