AppSec Issues can be identified in multiple places 1. At the level of Security Knowlege/Awareness Developer or Product Engineering Team 2. At security issues identified at the user-story/requirements 3. When the developer writes code 4. When the code is built into an artifact 5. When the artifact is deployed in production A hallmark of a really successful AppSec program is when you can restrict most of the big security Issues to 1 and 2 As you move further down the pipe, you start to fail.

Earlier "Secure Coding Training" used to mean - Secure coding - backend - Secure coding - front-end Now it means: - Secure coding - backend - Secure coding - frontend - Securing Kubernetes and Manifests - Securing Cloud & IaC - Securing Secrets - Securing CI/CD

What are the native tools for AWS Security Incident Response? Training a class on Cloud Security Incident Response for a $BIGBANK next week and it's full of our Attack-Detect-Defense labs on the cloud with a focus on detection. Thought I'd share this with all of you

I love when tools that devs use as part of their workflow can be used as security tools. It solves several problems: * The adoption problem * The problem of separation of "security" vs everything else * The reduction of cognitive load when devs have to use yet another tool (and some security tools truly suck). It's even better when that tool is fast I discovered "ruff" today. Its a python linter from the @astral_sh team. It's a super fast linter with solid security rules from one of my fave python security tools, bandit docs.astral.sh/ruff/rules/#f…

Underrated #AppSec and #DevSecOps patterns for outsized wins 🦸‍♂️ High fidelity SAST run on PRs/MRs - High Speed, High Accuracy 👍 Wrapper libraries or secure defaults 📋 Threat Modeling from the requirements stage 🖋️ Signing binaries/containers/output artifacts

Them: As an industry, we've barely scratched the surface of grasping Application Security Supply-Chain security issues GenAI and LLM apps: Hold my beer!

🗒️ Security Architecture Review, especially done well can lead to: 🏗️ Identifying major flaws even before they happen 👩‍🏫 Higher security awareness of all product stakeholders. Better awareness == more support 👨‍💻 More deliberate app dev with massive gains beyond just security

"There's a Security Skills Shortage!" Is all I head when I talk to companies. And on first glance, it seems to be absolutely true. But... Let's look at why this may be happening. I see this as a problem with the way security work is done at a lot of companies. Security work is basically handled by a security team. And there are obviously very limited, qualified, skilled security people who will be part of your security team. They need to basically carry ALL of the security activities on their shoulders, ranging from Bounty Triage to Pentesting, to Secure Code Review, DevSecOps, Threat Modeling, IR, Cloud Security, $insertThingHere. The list only gets bigger as technology changes (and it changes often), or as new threats emerge (and they emerge often as well). Security Teams are burned out. And I think a lot of people will agree with me. I think this problem is largely because of inconsistency in skills. Let's look at scenarios where this might happen - "We can't do good threat models because only the expert Security Architect can identify viable/relevant threats" - "Our developers don't know how to deal with SSRF because they don't know what it is" - "Our DevOps team is not aware of how we can setup resource policies on our massive AWS Organizations deployment" There's a huge gap of skills between security people, with typically higher security skills and other tech folks, who're good at tech, but have a pretty large gap in security knowledge and skills. IMO, and have seen this in the best security teams. Its FAR FAR easier, cheaper and more scalable to get other (non-security folks) to level up on their knowledge and skills in security, than it is to constantly be on the lookout for these unicorn security folks. Your security program is likely to be more consistent. Its likely to be more resilient and more effective when you can drive a collective leveling up of security skills across the board. This is the way you get high quality security outcomes for your org.

If you’re a student of ours, you’d have received the weekly status update email showing your stats for the week. Yes, these are the courses (and counting we released last week). We effectively went from 9 courses in secure coding and appsec to over 60 and counting This is just the first of many releases that we have. We’re building at a furious pace and building some truly relevant and amazing content. Make 2024 your year of learning and breaking through with @AppSecEngineer