AppSec Terrain Check
What keeps my AppSec system fragile?
Fast assumptions
Initiatives around ownership, security culture, or an expensive new tool are always experiments based on assumptions. There is no guarantee that your money, time, and effort will pay off. That's the nature of complex problems.
Get a Terrain Check if you want to leverage deep system understanding to come up with grounded hypotheses.
Decide based on system understanding.
Shaky foundation
Your AppSec efforts won't succeed if you lack a strong foundation. How much impact your initiatives can have depends on the relationship between leadership and AppSec. You need a strong mandate and clear communication.
Get a Terrain Check if you want to strengthen your foundation with leadership and align your goals.
Thrive based on strong relationships.
Single point of failure
As AppSec Lead, you are the natural single point of failure of your AppSec system. That doesn't mean the system has to be visible only in your head. When you are unavailable, a well-documented System Manual can save the day.
Get a Terrain Check if you want a documented, transferable snapshot of your system that you can build upon.
Rest based on shared responsibility.
Why should I get a Terrain Check?
Because it keeps you from wasting your energy on the wrong problems.
Let me take you on a short trip into the Sahara to show you what I mean.
That evening I was tired, sweaty, and just wanted to get to my camp spot. Then suddenly, my car stopped. I knew it. But I didn't want to believe it. Annoyed, I hit the gas, and sand flew straight through the open window into my face. Awesome.
So I got out, aired down the tires, and started digging sand away to make room for the recovery boards. But my car just sat there like a stranded whale and refused to move an inch. "What the f...? Why is it not moving?!" I paused for a moment. Then I saw it: There was no weight on the wheels. My car was sitting on too much sand. "Yeah, more digging..."
But at least: I was finally solving the right problem.
Dealing with structural AppSec problems like unrealistic expectations, implicit responsibilities, and destructive cultural patterns is exhausting. But it is necessary.
The Terrain Check helps you identify the underlying problems that are undermining your AppSec efforts.
Why should I get a Terrain Check?
Because it keeps you from wasting your energy on the wrong problems.
Let me take you on a short trip into the Sahara to show you what I mean.
That evening I was tired, sweaty, and just wanted to get to my camp spot. Then suddenly, my car stopped. I knew it. But I didn't want to believe it. Annoyed, I hit the gas, and sand flew straight through the open window into my face. Awesome.
So I got out, aired down the tires, and started digging sand away to make room for the recovery boards. But my car just sat there like a stranded whale and refused to move an inch. "What the f...? Why is it not moving?!" I paused for a moment. Then I saw it: There was no weight on the wheels. My car was sitting on too much sand. "Yeah, more digging..."
But at least: I was finally solving the right problem.
Dealing with structural AppSec problems like unrealistic expectations, implicit responsibilities, and destructive cultural patterns is exhausting. But it is necessary.
The Terrain Check helps you identify the underlying problems that are undermining your AppSec efforts.
Who is the Terrain Check for?
You've already checked many boxes off the list. You have tools in place for vulnerability management, defined processes for incident response and zero-day management, and maybe even started your security champions program.
But still your software is not as secure as you'd planned?
That's expected. You've done all the necessary ground work, but you've mainly worked on complicated problems. Now you must deal with the world of complex problems. A world where you can only observe in retrospect why your solution worked. A world of hypotheses and experiments.
That's the point the Terrain Check can really help you.
I don't want to lie to you. The Terrain Check alone is not going to make your software secure. You know, you will still need to dig sand. But the Terrain Check provides you with the insights to know where you need to dig.
That means, you must be willing to work with the results.
Otherwise the Terrain Check will be just another waste of energy for you.
Who is the Terrain Check for?
You've already checked many boxes off the list. You have tools in place for vulnerability management, defined processes for incident response and zero-day management, and maybe even started your security champions program.
But still your software is not as secure as you'd planned?
That's expected. You've done all the necessary ground work, but you've mainly worked on complicated problems. Now you must deal with the world of complex problems. A world where you can only observe in retrospect why your solution worked. A world of hypotheses and experiments.
That's the point the Terrain Check can really help you.
I don't want to lie to you. The Terrain Check alone is not going to make your software secure. You know, you will still need to dig sand. But the Terrain Check provides you with the insights to know where you need to dig.
That means, you must be willing to work with the results.
Otherwise the Terrain Check will be just another waste of energy for you.
What do you get?
AppSec System Manual
The AppSec System Manual is a detailed, documented snapshot of your AppSec system. It lists your currently applied AppSec measures, all roles involved in developing secure software, and how responsibility is distributed among them.
It will assess your system from three different angles: who officially, actually, and ideally owns what.
It provides the system understanding you need to come up with grounded hypotheses to solve complex problems.
Leadership Briefing
The Leadership Briefing is tailored to your executive leadership.
It provides them with a high-level summary of your system's resilience, highlights underlying structural problems, and explains why those complex problems can only be addressed with structured experiments.
The briefing includes recommendations on how executive leadership shapes the success of your initiative. As the backbone of your system, their actions matter most.
Owner's Briefing
The Owner's Briefing is tailored to the AppSec Lead or team, the owner of your AppSec system.
It provides them with detailed guiding instructions on how to work with the AppSec System Manual and how to keep it up-to-date.
The briefing includes a set of grounded hypotheses about where their system is currently most fragile and recommendations on how these can be tested with structured experiments.
Ready to face your complex AppSec problems?
Awesome. Let's have a campfire talk about your AppSec challenges. Ok, no campfire. Just AppSec.
Still wondering if the Terrain Check works for you?
