AppSec Adventure
Can you trust it when...
...your security hero is gone?
Every organization has these security heroes you can just call when something bad happens.
Who are your security heroes? What happens when they are on holiday, sick or simply leave tomorrow?
Who would fix it then?
...delivery pressure spikes?
This new feature or product that should have been shipped yesterday? We've all been there.
What corners would get cut to speed up delivery? Would you even notice when security gets cut?
What would get sacrificed?
...a critical incident hits?
No security budget can ensure your software will be 100% secure. Incidents are part of the game.
So let's face it: would a critical incident turn into a disaster, or are you prepared to handle it smoothly?
How painful would it be?
What causes AppSec programs to break down?
They are built on a false assumption.
Most AppSec programs focus on tools, policies and processes. Some may even go further by including people through training and Security Champions programs.
Nothing wrong with that, as long as you are on a paved road.
Besides all those measures, you are dealing with conflicting priorities, cultural friction, implicit expectations, unclear responsibilities, different personalities and always limited budget.
Does this sound like a nicely paved road?
Your terrain is much closer to navigating a rough off-road track with mud, deep sand or sharp rocks. Maybe you even need to cross a few rivers.
That's why you need to build a resilient AppSec system.
What causes AppSec programs to break down?
They are built on a false assumption.
Most AppSec programs focus on tools, policies and processes. Some may even go further by including people through training and Security Champions programs.
Nothing wrong with that, as long as you are on a paved road.
Besides all those measures, you are dealing with conflicting priorities, cultural friction, implicit expectations, unclear responsibilities, different personalities and always limited budget.
Does this sound like a nicely paved road?
Your terrain is much closer to navigating a rough off-road track with mud, deep sand or sharp rocks. Maybe you even need to cross a few rivers.
That's why you need to build a resilient AppSec system.
How does a resilient AppSec system differ?
A common AppSec program is basically a set of isolated measures. Success is often measured by activity. How many developers did you train? How many vulnerabilities where discovered and closed?
But AppSec doesn't happen isolated.
It is built around an existing system that produces software: your Software Development Lifecycle (SLDC). AppSec just enhances this system to make sure, the output is secure.
Let's imagine you want to reach North Cape in winter. The last kilometers can only be driven in a convoy behind a snowplow because the conditions are so harsh.
At that point, success is no longer just about a car that can handle the conditions.
The road must stay open. The convoy must work together. The snowplow must clear the road. The entire system must continue to function despite difficult conditions.
That's the difference:
AppSec programs can work for years while individual heroes compensate for missing system resilience. In a resilient AppSec system, you don't need heroes.
You design a system that can handle rough conditions.
How does a resilient AppSec system differ?
A common AppSec program is basically a set of isolated measures. Success is often measured by activity. How many developers did you train? How many vulnerabilities where discovered and closed?
But AppSec doesn't happen isolated.
It is built around an existing system that produces software: your Software Development Lifecycle (SLDC). AppSec just enhances this system to make sure, the output is secure.
Let's imagine you want to reach North Cape in winter. The last kilometers can only be driven in a convoy behind a snowplow because the conditions are so harsh.
At that point, success is no longer just about a car that can handle the conditions.
The road must stay open. The convoy must work together. The snowplow must clear the road. The entire system must continue to function despite difficult conditions.
That's the difference:
AppSec programs can work for years while individual heroes compensate for missing system resilience. In a resilient AppSec system, you don't need heroes.
You design a system that can handle rough conditions.
How do you build a resilient AppSec system?
There is no bluprint for resilient AppSec systems yet. Best practices already solve the easy problems. Expert analysis can handle complicated ones.
My research begins where those approaches stop working.
The problems that matter most are the complex ones. They live in off-road terrain, so there is no predefined route from A to B.
- Build a strong security culture.
- Distributed responsibility in a way people can actually take ownership.
- Get so well prepared to handle incidents that nothing can really shock you.
That's what I aim to solve in a resilient AppSec system.
The only way to get there? Through running structured experiments to challenge a grounded hypothesis about your system. You collect data, learn from it and steer your system with new hypotheses and experiments.
Hypothesis. Experiment. Data. Learning. Repeat.
How do you build a resilient AppSec system?
There is no bluprint for resilient AppSec systems yet. Best practices already solve the easy problems. Expert analysis can handle complicated ones.
My research begins where those approaches stop working.
The problems that matter most are the complex ones. They live in off-road terrain, so there is no predefined route from A to B.
- Build a strong security culture.
- Distributed responsibility in a way people can actually take ownership.
- Get so well prepared to handle incidents that nothing can really shock you.
That's what I aim to solve in a resilient AppSec system.
The only way to get there? Through running structured experiments to challenge a grounded hypothesis about your system. You collect data, learn from it and steer your system with new hypotheses and experiments.
Hypothesis. Experiment. Data. Learning. Repeat.
How can you help me with my AppSec system?
Terrain Check
29,000 USD
If you are facing a high-stakes decision, invest in a Terrain Check first.
The resulting AppSec Owner's Manual provides you with transferable system understanding to strengthen your current hypothesis and to make better-informed decisions before committing substantial resources in the future.
Trail Guide
Custom engagement
If you already have a hypothesis and want support while steering your AppSec system, the Trail Guide is for you.
I help you turn your hypothesis into a structured experiment, define what you need to observe in the field and collect the data required to learn from the experience.
Why resilience matters to me
When I built my own AppSec program from scratch, I was just a developer suddenly handed responsibility for AppSec. Of course I made the same mistake. I kept pushing and became the security hero. When I took 3 months off to travel, nothing moved.
That's when I knew I had to start building a system that works without me.
After I left the company, I embraced traveling overland full-time. The ultimate freedom: just me, my dog, and my Chevy on the road. I soon learned I had heavily underestimated the fact I was giving up all traditional safety nets: no home, no regular paycheck.
Then I faced the worst case: engine damage in the Pyrenees.
My entire lifestyle depended on that old Chevy, and it was gone. But the system I had built around it was resilient. My mindset, resources and my great support network got me back on the road with a new Chevy Blazer.
Losing my car was painful, but the experience proved that I can trust my system.
To be truly free, we need security built from within. We need a resilient system.
Why resilience matters to me
When I built my own AppSec program from scratch, I was just a developer suddenly handed responsibility for AppSec. Of course I made the same mistake. I kept pushing and became the security hero. When I took 3 months off to travel, nothing moved.
That's when I knew I had to start building a system that works without me.
After I left the company, I embraced traveling overland full-time. The ultimate freedom: just me, my dog, and my Chevy on the road. I soon learned I had heavily underestimated the fact I was giving up all traditional safety nets: no home, no regular paycheck.
Then I faced the worst case: engine damage in the Pyrenees.
My entire lifestyle depended on that old Chevy, and it was gone. But the system I had built around it was resilient. My mindset, resources and my great support network got me back on the road with a new Chevy Blazer.
Losing my car was painful, but the experience proved that I can trust my system.
To be truly free, we need security built from within. We need a resilient system.
