3 ms·

I wasn't aware that was a big problem. My company is a large corporate company and I feel we lag behind a lot of things. However we have automated static code a

by fma 10y ago

I wasn't aware that was a big problem. My company is a large corporate company and I feel we lag behind a lot of things. However we have automated static code analysis through HP Fortify. It points to our build, scans and reports are generated automatically. Someone on the app security team needs to run the HP Webscan for pen test. I'm a senior developer and I made a name for myself when we started having the requirement. I helped secure ~10 webapps as I was the most knowledgeable about security amongst the devs. The app sec guys I know at my company, though intelligent, are not strong developers. There were times I spun a story to get them to mark something as false positive - or I knew what the scan flagged for and coded around it. I know, bad practice, but sometimes the scanners mark something as critical when IMHO it's not. Once our apps were secure, maintenance is pretty low as we'd just fix any new vulnerabilities introduced by coding, or updated by the scanner tools. Do you see a need for strong developers in app sec world? If so, any recommendations on ways to make the leap? Not really looking for something where I just click a button and scan...but something more in depth that would use my development experience. I have a Security+ cert, doubt I can get a CISSP since I don't know anyone with it to get sponsored.

eganist 10y ago
Some mature orgs have done a good job of automating this, but it really depends on the industry. Finance and FinTech, for instance, are ahead of the curve here. Most government entities on the other hand don't even realize there's a curve ahead, as do many utilities companies and some healthcare firms. So to your point about it being a big problem, "it depends on the company." As for strong developers in the appsec world, certainly. Especially if you have a strength in the automation side, you can easily carve a niche out for yourself. The main two areas where I can see a dev taking charge are in driving the use of security features in frameworks product teams already use (this is a HUGE bullet being pushed by notables in AppSec as it reduces the effort involved in uptake of secure coding practices) as well as in leading automation of new tooling in support of new frameworks. There's also the angle of developing custom solutions to address firm-specific problems, something appsec people without a strict development background will have a hard time doing. Quite a few appsec leads prefer bringing in developers with a breaker mindset in as appsec hires, so yes, there's always room. Depending on how you answer the question "what does 'secure ~10 webapps' mean?", you can probably easily score a lateral move into AppSec (Senior Dev -> Senior Security Engineer or Senior AppSec Consultant/Engineer). My keybase profile has all my contact info if you want more tailored guidance. Even if you don't join my firm or any of the other firms I have a hand in shepherding, we desperately need more people in appsec, so I'm all about sharing this knowledge.

by fma 10y ago

eganist 10y ago

Some mature orgs have done a good job of automating this, but it really depends on the industry. Finance and FinTech, for instance, are ahead of the curve here. Most government entities on the other hand don't even realize there's a curve ahead, as do many utilities companies and some healthcare firms. So to your point about it being a big problem, "it depends on the company." As for strong developers in the appsec world, certainly. Especially if you have a strength in the automation side, you can easily carve a niche out for yourself. The main two areas where I can see a dev taking charge are in driving the use of security features in frameworks product teams already use (this is a HUGE bullet being pushed by notables in AppSec as it reduces the effort involved in uptake of secure coding practices) as well as in leading automation of new tooling in support of new frameworks. There's also the angle of developing custom solutions to address firm-specific problems, something appsec people without a strict development background will have a hard time doing. Quite a few appsec leads prefer bringing in developers with a breaker mindset in as appsec hires, so yes, there's always room. Depending on how you answer the question "what does 'secure ~10 webapps' mean?", you can probably easily score a lateral move into AppSec (Senior Dev -> Senior Security Engineer or Senior AppSec Consultant/Engineer). My keybase profile has all my contact info if you want more tailored guidance. Even if you don't join my firm or any of the other firms I have a hand in shepherding, we desperately need more people in appsec, so I'm all about sharing this knowledge.