1
00:00:13,000 --> 00:00:15,160
Welcome to Day 2 of AppSec Village.

2
00:00:15,160 --> 00:00:17,300
I am your queen, Leora Herman.

3
00:00:17,860 --> 00:00:20,540
You might notice that I am sans tiara this year.

4
00:00:20,720 --> 00:00:23,260
That bling is saved for in-person occasions.

5
00:00:23,740 --> 00:00:29,020
I hope you enjoyed yesterday and are geared up for another great day of fun in AppSec.

6
00:00:29,080 --> 00:00:33,280
Speaking of gear, I am inserting a shameless plug for AppSec gear.

7
00:00:33,280 --> 00:00:40,660
If you go to appsecvillage.com and click on shop, you can get your own village merch, which helps support our volunteer-run village.

8
00:00:40,660 --> 00:00:43,160
Okay, plug for merch over.

9
00:00:43,720 --> 00:00:51,160
No village is without its challenges, and I'm still not quite sure how lockpicking village is managing in safe mode.

10
00:00:51,760 --> 00:00:58,160
So, no village is without its challenges, and year 2 of AppSec Village brought with it its own set.

11
00:00:58,520 --> 00:01:03,460
With DEF CON going virtual, all of our combined superpowers were needed to pull this off.

12
00:01:03,460 --> 00:01:10,020
We really appreciate your patience and the cooperation of our speakers and volunteers as we worked things out.

13
00:01:10,020 --> 00:01:14,220
It has not been smooth sailing, but we made it.

14
00:01:14,300 --> 00:01:19,300
If you were with us last year, you heard how much we value the diversity of our community.

15
00:01:19,920 --> 00:01:30,180
I'm not just talking about race, religion, or political views, but diversity in sexuality and gender identity, level of formal education, and security experience.

16
00:01:30,700 --> 00:01:36,040
Talking about diversity is just words, and what are words without actions?

17
00:01:36,220 --> 00:01:39,280
We must actively embody our ideals every day.

18
00:01:39,280 --> 00:01:46,660
And as you can see from this year's leadership, our keynotes, and the speaker lineup, we have put our words into actions.

19
00:01:46,760 --> 00:01:52,980
And our first talk for today is certainly action-packed, kicking off day 2 as Frederick Flea Lee.

20
00:01:53,080 --> 00:02:03,180
Flea is the CISO at Gusto, the people platform that enables 100,000 plus small businesses nationwide to pay, insure, and provide benefits for their teams.

21
00:02:03,640 --> 00:02:11,120
Flea previously headed up information security at Square and held senior security roles at Bank of America, Twilio, and NetSuite.

22
00:02:11,320 --> 00:02:16,140
His keynote is Be Like Water, what Bruce Lee can teach us about AppSec.

23
00:02:16,140 --> 00:02:19,570
Please join me in welcoming Flea to the virtual stage.

24
00:02:20,500 --> 00:02:26,600
As of the recording of this talk, the killers of Breonna Taylor have not been charged.

25
00:02:33,920 --> 00:02:43,040
Hey everybody, welcome to my keynote, and welcome to DEF CON Day 2 AppSec Village.

26
00:02:43,040 --> 00:02:45,140
I'm super excited to be here.

27
00:02:45,140 --> 00:02:50,560
I noticed definitely, definitely, definitely unusual circumstances.

28
00:02:51,300 --> 00:02:59,800
Bruce Lee and how I believe he relates to application security and some of the things that we can actually learn from him.

29
00:02:59,900 --> 00:03:04,140
Obviously, there's a couple of things, you know, kind of get out of the way, which is introductions.

30
00:03:04,140 --> 00:03:06,720
As I said, my name is Frederick Lee.

31
00:03:06,720 --> 00:03:09,540
Most people call me Flea.

32
00:03:09,560 --> 00:03:12,840
And I want to talk to you, you know, about what I do.

33
00:03:12,840 --> 00:03:15,800
I'm currently the CISO of a company called Gusto.

34
00:03:15,800 --> 00:03:27,260
We're actually focused on building a people platform that enables small and medium sized businesses to kind of give their employees all those things that, you know, one would want to have a delightful work experience.

35
00:03:27,260 --> 00:03:29,380
Gusto is not the only place I've worked at, right?

36
00:03:29,380 --> 00:03:34,020
I mean, I've also, you know, led security at Square, a fintech company.

37
00:03:34,480 --> 00:03:36,820
You know, I led security at NetSuite.

38
00:03:36,820 --> 00:03:38,620
You had a SaaS company.

39
00:03:38,620 --> 00:03:40,040
I was at Twilio.

40
00:03:40,380 --> 00:03:42,260
I was also at Betfair.

41
00:03:42,260 --> 00:03:46,900
So for those of you, you know, fricket gamblers, et cetera, you might remember that name.

42
00:03:47,340 --> 00:03:51,880
Fortify, many, many moons ago, and even Bank of America.

43
00:03:52,100 --> 00:03:56,820
Those are all just like random companies, all random and all really, really different.

44
00:03:56,820 --> 00:03:59,680
And I've had numerous different roles over the years.

45
00:03:59,680 --> 00:04:02,580
Like I started my career as a software developer.

46
00:04:02,580 --> 00:04:04,520
I'm just writing code like a lot of you.

47
00:04:04,520 --> 00:04:13,820
But I've also spent time being a sysadmin, including, you know, like crawling through spaces and running cables, et cetera.

48
00:04:14,200 --> 00:04:16,440
You know, it's a really, really fulfilling job.

49
00:04:16,440 --> 00:04:18,720
I took that and then I decided, hey, you know what?

50
00:04:18,720 --> 00:04:25,980
I want to actually spend more time going back to my roots as a security researcher, practicing security in various different places.

51
00:04:25,980 --> 00:04:30,800
And I've been fortunate enough to actually be on several different world class security teams.

52
00:04:30,800 --> 00:04:42,640
And I've also been fortunate enough to become a security leader, both as just a direct line manager, director, and ultimately, you know, a couple of stints as being a CISO.

53
00:04:42,680 --> 00:04:50,860
With all those things said, you know, similar to my previous experience at other companies, all those roles are also different.

54
00:04:51,280 --> 00:04:54,240
But really, none of that should matter.

55
00:04:54,240 --> 00:04:55,020
Right?

56
00:04:55,020 --> 00:04:58,920
We always do these things in slides, in particular in keynotes, et cetera.

57
00:04:58,920 --> 00:05:20,480
Like, oh, let me tell you a little bit about my history with the idea that somehow me having experience being more mature, we just put it that way, and having several decades under my belt, it's somehow meaning that I have something to teach you or that you should be paying attention to me,

58
00:05:20,480 --> 00:05:26,260
that you should view people such as myself as, quote unquote, thought leaders.

59
00:05:26,600 --> 00:05:29,140
But really, you don't care about my background.

60
00:05:29,140 --> 00:05:30,440
Hopefully you don't.

61
00:05:30,780 --> 00:05:34,580
Hopefully you're really here because like me, you hear more about Bruce.

62
00:05:34,580 --> 00:05:45,100
Bruce Lee is one of my idols and somebody I look up to both as just a good human being and some of the phenomenal things that he's actually done throughout his life.

63
00:05:45,100 --> 00:05:49,220
And also as a philosopher and some of the things that we can take away from that.

64
00:05:49,220 --> 00:05:54,380
So for those of you that aren't familiar with Bruce Lee, he's a native San Franciscan.

65
00:05:54,380 --> 00:06:01,820
A lot of people actually don't know that, you know, probably his big claim to fame is all of the martial arts movies that he's been in.

66
00:06:01,820 --> 00:06:07,120
You know, Big Boss, Enter the Dragon, which, you know, obviously everybody knows.

67
00:06:07,260 --> 00:06:14,600
But some of the other things I think people forget about, it's like a lot of the work that he's done just in general to make the world a better place.

68
00:06:14,600 --> 00:06:19,300
He was instrumental in breaking down lots and lots of stereotypes.

69
00:06:19,300 --> 00:06:25,220
So like stereotypes around like Asians in Hollywood and just Asians in society in general.

70
00:06:25,220 --> 00:06:39,400
Like he made it OK slash essentially effectively broke through to have strong leading roles for Asians and strong leading roles, particularly for Asian men.

71
00:06:39,400 --> 00:06:46,060
But he did even more outside of his Hollywood career because he was a world class martial artist.

72
00:06:46,060 --> 00:06:58,000
And he was a big proponent not only of practicing martial arts, but making martial arts available to everybody, regardless of your race, gender, body style, etc.

73
00:06:58,000 --> 00:07:03,220
He pushed back on the belief that there was only one type of person.

74
00:07:03,220 --> 00:07:10,660
And he also pushed back on the belief that there's only one style of martial arts that was suitable for all things.

75
00:07:10,660 --> 00:07:13,920
He really was a Renaissance man.

76
00:07:13,920 --> 00:07:23,120
He believed in constantly learning and constantly growing, studying everything from boxing to ballet, even philosophy.

77
00:07:23,940 --> 00:07:31,620
He's also known for beating up Wong Jack Man, a Kung Fu practitioner in Oakland.

78
00:07:32,060 --> 00:07:47,200
And what was interesting about this situation was that it was related to Bruce Lee's desire to make sure that his learnings and his philosophy and just the advantages of martial arts were available to all people.

79
00:07:47,200 --> 00:07:58,540
At a time when a lot of people felt that martial arts, in particular Kung Fu, should only be taught to Chinese people and should not be available to other races.

80
00:07:58,540 --> 00:08:03,140
I love this quote that actually recounts Bruce Lee's perspective on the fight.

81
00:08:03,140 --> 00:08:04,420
And I'll just read it for you.

82
00:08:04,420 --> 00:08:07,900
I'd gotten into a fight in San Francisco with a Kung Fu cat.

83
00:08:07,900 --> 00:08:10,740
And after a brief encounter, the son of a bitch started to run.

84
00:08:10,740 --> 00:08:15,080
I chased him and, like a fool, kept plunging him behind his head and back.

85
00:08:15,080 --> 00:08:19,400
Soon, my fists began to swell from hitting his hard head.

86
00:08:19,480 --> 00:08:26,880
Right then, I realized Wing Chun was not too practical and began to alter my way of fighting.

87
00:08:26,880 --> 00:08:34,800
This really was kind of like the birth and the inspiration of Bruce Lee to start seeking out better ways to practice martial arts.

88
00:08:34,800 --> 00:08:46,860
And ultimately, Lin, you know, lent his way towards creating Jeet Kune Do, a form and his philosophy of martial arts, which essentially means the way of an intercepting fist.

89
00:08:48,040 --> 00:08:54,140
Bruce Lee is probably the first true, quote unquote, mixed martial artist.

90
00:08:54,140 --> 00:08:57,220
He described his style as hybrid fighting.

91
00:08:58,500 --> 00:09:01,360
So Jeet Kune Do, what exactly is it?

92
00:09:01,360 --> 00:09:02,760
What is it about, etc.?

93
00:09:02,760 --> 00:09:18,720
One of the key principles of Jeet Kune Do is that it's focused on the outcome of a fight, not just the kata, not just practices, not just forms, but really the ultimate goal, which is to essentially stop the fight.

94
00:09:18,720 --> 00:09:32,660
He wanted to make sure that his form of martial arts and his philosophy got rid of the dogma, that it allowed you to leverage all the techniques across a wide gamut of martial arts.

95
00:09:32,740 --> 00:09:42,160
He also wanted to make sure that when he was training and that his students were training, that they were actually training for realistic scenarios, not just sparring matches and not just Kung Fu competitions.

96
00:09:42,160 --> 00:09:47,300
He felt that you needed to be constantly preparing yourself and constantly conditioning yourself.

97
00:09:47,300 --> 00:09:56,220
And that with that combination of letting go of dogma and constant preparation, you could ultimately get to a fluid state.

98
00:09:56,220 --> 00:09:59,980
So you're always prepared without being stressed.

99
00:09:59,980 --> 00:10:06,860
He was a permanent student and he believes that all people should always be learning.

100
00:10:06,860 --> 00:10:19,320
I love this quote by him and I think there's so much for us to take away from it, which is absorb what is useful, reject what is useless, add what is essentially your own.

101
00:10:21,300 --> 00:10:32,700
I have not invented a new style, composite, modified or otherwise, that is set within distinct form as apart from this method or that method.

102
00:10:32,700 --> 00:10:39,700
On the contrary, I hope to free my followers from clinging to styles, patterns or molds.

103
00:10:40,260 --> 00:10:43,180
So what does this have to do with APSEC?

104
00:10:43,180 --> 00:10:44,760
I understand you.

105
00:10:44,760 --> 00:10:47,300
This seems like a really, really drawn out analogy.

106
00:10:47,360 --> 00:10:50,880
I promise you that there is something here.

107
00:10:51,840 --> 00:10:59,840
I believe that APSEC has actually fallen into a lot of the same traps that previous martial arts practitioners had.

108
00:10:59,840 --> 00:11:04,840
There was always this idea that, oh, my style is superior to your style.

109
00:11:04,840 --> 00:11:08,460
I'm going to go to your dojo and challenge your master, etc.

110
00:11:08,460 --> 00:11:12,980
And we have a lot of those same tendencies inside of security.

111
00:11:12,980 --> 00:11:16,580
Instead of senseis, we have thought leaders.

112
00:11:18,340 --> 00:11:20,920
I'm OK with that actually being an insult.

113
00:11:20,920 --> 00:11:28,420
I've been called that myself and I've probably been guilty of perpetuating some of the same problems that these thought leaders are doing.

114
00:11:28,420 --> 00:11:31,120
We are heavily relied upon dogma.

115
00:11:31,120 --> 00:11:36,000
There are some people like, oh, if you're not practicing DevSecOps, then you're not really practicing APSEC.

116
00:11:36,000 --> 00:11:38,060
Your security program isn't going to work.

117
00:11:38,060 --> 00:11:42,940
There are others that believe like, oh, you need to be following something that's from NIST.

118
00:11:42,940 --> 00:11:45,620
And that's how application security is supposed to be approached.

119
00:11:46,400 --> 00:11:51,440
Often we've kind of forgotten what the real point of application security is.

120
00:11:51,440 --> 00:12:00,120
When Jeet Kune Do, Bruce Lee thinks about this concept of, hey, the true purpose is to end the fight.

121
00:12:00,120 --> 00:12:07,780
Inside of application security, our true purpose is to actually create and have secure outcomes.

122
00:12:07,860 --> 00:12:12,100
Another issue that we have in application security is that we often get distracted, right?

123
00:12:12,100 --> 00:12:15,040
We're distracted by whatever the latest zero day is.

124
00:12:15,040 --> 00:12:28,260
Instead of actually really thinking about the common threads, like in Jeet Kune Do, Bruce Lee wanted people to focus on realistic fighting, not just these outliers and things like that, the things you're going to come across on a day to day basis.

125
00:12:29,200 --> 00:12:31,960
Also, we have similar problems with gatekeeping.

126
00:12:32,700 --> 00:12:37,600
You know, there's a lot more we can actually be doing to actually bring more people into application security.

127
00:12:37,880 --> 00:12:46,920
But we've always kind of perpetuated this myth, either intentionally or unintentionally, that AppSec is only for these blessed few and they have to look a certain way.

128
00:12:46,920 --> 00:12:52,100
They had to, you know, belong to certain crews and cliques or they had to have gone to a certain school.

129
00:12:52,420 --> 00:13:00,700
Ultimately, we've latched onto these ideas so hard and we've been so inflexible that we're really like a rock.

130
00:13:01,640 --> 00:13:04,740
Instead, we must be like water.

131
00:13:06,920 --> 00:13:10,300
So let's actually talk about Jeet Kune Do for AppSec.

132
00:13:11,700 --> 00:13:15,960
I want to start a little bit actually talking about the styles of AppSec.

133
00:13:15,960 --> 00:13:16,440
Right .

134
00:13:16,800 --> 00:13:19,380
There is the traditional style.

135
00:13:19,500 --> 00:13:26,020
And I think, you know, in particularly some of you that are older or maybe actually work in a large organization, you might actually be familiar with this.

136
00:13:26,020 --> 00:13:29,500
Generally, the traditional style is guided by compliance.

137
00:13:29,500 --> 00:13:31,000
Hey, what are the regulations?

138
00:13:31,100 --> 00:13:33,840
What are the things we have to do to check the box?

139
00:13:33,940 --> 00:13:37,920
It's heavily focused on testing and auditing.

140
00:13:37,920 --> 00:13:49,660
It works really, really well with more traditional SDLCs, like companies that are releasing software once or twice a year, probably still practicing a waterfall type methodology.

141
00:13:49,660 --> 00:13:53,760
Like I said, it's really, really common in large corporations.

142
00:13:53,800 --> 00:13:59,600
And because of that, they're often just focused on buying tools like, hey, let me go get a license for Fortify.

143
00:13:59,600 --> 00:14:06,140
Let me go get a really expensive license for some dynamic testing suite, etc.

144
00:14:06,140 --> 00:14:09,460
But there actually are a lot of good things about this style.

145
00:14:09,460 --> 00:14:12,080
Like one, it actually is predictable and repeatable.

146
00:14:12,080 --> 00:14:12,560
Right.

147
00:14:12,600 --> 00:14:21,140
And it's great because nobody is surprised by what is expected and what is going to happen when the application security team engages with them.

148
00:14:21,140 --> 00:14:24,100
You produce a lot of artifacts and a lot of evidence.

149
00:14:24,260 --> 00:14:26,260
That sounds like a lot of paperwork.

150
00:14:26,300 --> 00:14:35,540
But in particular, in heavily regulated industries, that is great when you have to deal with auditors because auditors actually understand it and it makes them happy.

151
00:14:35,540 --> 00:14:40,740
It allows for a lot of control over development and over the developers.

152
00:14:40,920 --> 00:14:48,960
And it makes executives at these large corporations really, really comfortable because they can always go back and say, look, we followed the best practices.

153
00:14:48,960 --> 00:14:52,360
We're doing what all the other large corporations are doing.

154
00:14:52,440 --> 00:14:54,540
Look at how rigid and in control we are.

155
00:14:54,720 --> 00:14:56,580
And that gives them a lot of comfort.

156
00:14:56,580 --> 00:15:00,040
It also is kind of a good way to have some deniability.

157
00:15:00,740 --> 00:15:09,740
One other good thing about it is because of this really, really aggressive, maybe oppressive, pops down style, is that it makes it really easy to have mandatory developer training.

158
00:15:09,740 --> 00:15:21,840
And I think everybody believes that when developers know more about security and developing good, secure software, they generally have fewer security vulnerabilities.

159
00:15:22,120 --> 00:15:23,640
Obviously, this isn't perfect.

160
00:15:23,640 --> 00:15:28,240
There's a reason why tons of people no longer use this methodology.

161
00:15:28,240 --> 00:15:30,600
One, it slows down developers.

162
00:15:30,720 --> 00:15:33,940
And that can definitely have an impact on your competitive advantage.

163
00:15:34,000 --> 00:15:38,640
It over, over, over indexes on compliance and process, etc.

164
00:15:38,640 --> 00:15:47,160
And oftentimes people and companies forget about addressing true risk because they're so worried about checking boxes.

165
00:15:47,860 --> 00:15:51,440
These are the kind of situations where you have to have a large AppSec team.

166
00:15:51,440 --> 00:16:01,080
There's no way that you can actually do these many reviews, do this much process with a 4, 5, 10, even a 15-person AppSec team.

167
00:16:01,140 --> 00:16:09,580
The other big thing is that that part that the execs like, that deniability aspect, it's not the same as actually being secure.

168
00:16:09,620 --> 00:16:14,420
Yes, just because you won't get carted away to jail when you're in front of Congress, etc.

169
00:16:14,420 --> 00:16:22,840
after your breach, it doesn't mean that you actually did the right thing by your customers and by the rest of the ecosystem that relies upon you.

170
00:16:22,860 --> 00:16:26,400
Another thing is that it also kind of separates the security team from the developers.

171
00:16:26,560 --> 00:16:36,680
And oftentimes the security team doesn't really understand the code base or the product because they're really focused on trying to just find holes and go through a process.

172
00:16:37,000 --> 00:16:41,600
And that can also lead towards a lot of conflict with developers.

173
00:16:41,600 --> 00:16:46,420
And finally, at least personally, I find this style to be soul crushing.

174
00:16:46,940 --> 00:16:52,400
You know, this is part of my job when I was at Bank of America, and it really can be confining.

175
00:16:52,400 --> 00:16:59,060
And also having that antagonistic relationship as somebody who identifies as an engineer just isn't fun.

176
00:17:00,260 --> 00:17:10,000
What a lot of people actually practice now is kind of like this DevSecOps, DevOps, you know, whatever acronyms you want to use, security engineering, etc.

177
00:17:10,000 --> 00:17:13,840
This more agile application security type practice.

178
00:17:13,840 --> 00:17:18,220
It's a great thing in the aspect that it really is heavily guided by engineering.

179
00:17:18,400 --> 00:17:19,660
And that's really, really good.

180
00:17:19,660 --> 00:17:26,200
Having an application security team that is our engineers and can relate to engineers just pays dividends.

181
00:17:26,500 --> 00:17:30,440
The security team is there to actually just, you know, kind of like you write code and design systems.

182
00:17:30,440 --> 00:17:41,700
They really are about building golden paths, building safe defaults, other things that actually just make a developer's life much easier because the developer doesn't have to worry about security as much.

183
00:17:41,700 --> 00:17:56,540
I was often also focused heavily on this idea that if you can build the right golden path, then the developers can actually have a lot more freedom to exercise their creativity and actually launch interesting and good products.

184
00:17:56,540 --> 00:18:04,800
You see this style very much in startups or probably the best way to describe it is Silicon Valley style technology companies.

185
00:18:04,860 --> 00:18:08,240
But I love the fact that it does have this engineering first focus.

186
00:18:08,440 --> 00:18:12,740
You know, it's like I said, it's a lot of good that comes out of this because code scales.

187
00:18:12,740 --> 00:18:21,260
And what that means is you can also have a really, really lean security team and they can move kind of close to the developer speed.

188
00:18:21,260 --> 00:18:27,560
You can get a really, really good understanding of the code and what the actual product goals are by the security team.

189
00:18:27,560 --> 00:18:33,500
And that allows the AppSec team to really make pragmatic choices in some of the things that they're building.

190
00:18:33,600 --> 00:18:40,480
And also they're more focused on preventative measures as opposed to just purely detective measures, which is more like the traditional style.

191
00:18:40,960 --> 00:18:43,980
As much as I love this style, it isn't perfect either.

192
00:18:43,980 --> 00:18:53,100
Like one of the big things is that oftentimes because there's not a huge paper trail or a lot of things are actually more innovative, it's hard for external regulators to understand.

193
00:18:53,100 --> 00:18:57,540
And that can lead to gaps and potential issues and sometimes even fines.

194
00:18:59,060 --> 00:19:03,120
Because often these security teams are really, really lean.

195
00:19:03,560 --> 00:19:10,780
You can find yourself in a scenario where even if you have a lot of high caliber security engineers, they still get overwhelmed by the developers.

196
00:19:10,780 --> 00:19:16,500
In general, the broader development team is still going to be larger than your AppSec team.

197
00:19:16,500 --> 00:19:33,640
And then finally, when I put my pointy-haired hat on or pointy-haired boss hat on or whatever, it's difficult to actually find really, really good AppSec engineers that can code, understand security, understand how to actually build things that make developers easier.

198
00:19:33,640 --> 00:19:37,980
And those AppSec engineers tend to be a little bit more expensive.

199
00:19:38,780 --> 00:19:48,540
There's another style, though, that I find interesting, and I think a lot of you have probably been there before or at least know people that are there, which is a style called the pleading and prayer style.

200
00:19:49,040 --> 00:19:53,700
And this is generally characterized by a company that's more guided by cost.

201
00:19:53,700 --> 00:20:00,720
These generally tend to be smaller companies, maybe like a really, really small startup, like maybe less than 10 people.

202
00:20:00,720 --> 00:20:04,140
Like they're not they don't think they're ready yet for a security team.

203
00:20:04,140 --> 00:20:13,420
And also some companies that don't consider themselves technology companies, like maybe it's an architectural firm or a law firm or maybe it is a financial institution.

204
00:20:13,420 --> 00:20:15,920
And so they don't really think they deal with software.

205
00:20:15,920 --> 00:20:20,540
They don't think that they have application security type problems.

206
00:20:20,820 --> 00:20:22,220
You know, they don't think they're regulated.

207
00:20:22,220 --> 00:20:25,100
So there's no external pressure on them as well.

208
00:20:25,100 --> 00:20:31,600
And when security needs do arise, they rely more on this kind of like volunteer firefighter department type method.

209
00:20:31,600 --> 00:20:35,660
One of the good aspects of one of the things that makes it attractive about it is that it's cheap, right?

210
00:20:35,680 --> 00:20:38,460
You're not paying for security people.

211
00:20:39,060 --> 00:20:40,200
It's cheap, right?

212
00:20:40,200 --> 00:20:41,140
Less headcount.

213
00:20:41,140 --> 00:20:42,380
You're not buying tools.

214
00:20:42,380 --> 00:20:53,660
All these are the kind of things that can pile up that can seem like costs that are unnecessary because, you know, security can appear to be invisible unless something goes wrong.

215
00:20:53,940 --> 00:20:57,260
Ultimately, you know, statistics actually kind of on their side.

216
00:20:57,260 --> 00:21:02,060
But the reality is, is that most companies don't have a significant breach.

217
00:21:03,340 --> 00:21:06,260
There are definitely bad aspects of this, though, right?

218
00:21:06,260 --> 00:21:08,380
You know, literally you get what you pay for.

219
00:21:08,380 --> 00:21:10,580
I've told people this time and time again.

220
00:21:10,780 --> 00:21:13,840
Cheap security is generally expensive security, right?

221
00:21:14,540 --> 00:21:17,340
Statistics are on your side until they are not, right?

222
00:21:17,340 --> 00:21:22,460
When you roll the dice the wrong time, that one time it can be dramatically consequential.

223
00:21:22,620 --> 00:21:26,680
And when you don't have an AppSec team, you now find yourself in a bind.

224
00:21:26,680 --> 00:21:38,320
A lot of these companies forget that they are still utilizing software or writing software, even if it's a tiny amount that can still have some impact to their business and ultimately to their customers.

225
00:21:38,860 --> 00:21:48,820
No one in the company is even aware because no one in the company is focused on software security until something goes wrong.

226
00:21:48,820 --> 00:21:54,700
You know, one of the things that I've learned long ago is that ultimately software is eating the world.

227
00:21:54,700 --> 00:21:57,140
And that's what allows us to be so innovative.

228
00:21:57,140 --> 00:22:02,600
And that's also what allows us to have a virtual DEF CON here in COVID land.

229
00:22:04,720 --> 00:22:09,240
One thing that you notice about this, though, is that all of these styles work.

230
00:22:09,240 --> 00:22:11,520
They all work.

231
00:22:11,520 --> 00:22:17,200
As I mentioned, statistics kind of show that most companies don't get breached.

232
00:22:17,200 --> 00:22:18,400
Now, I say they all work.

233
00:22:18,400 --> 00:22:26,760
That doesn't necessarily mean that they're all secure and that it delivers the same level of security and resilience as some of the other styles.

234
00:22:26,760 --> 00:22:32,000
But the reality is, is that, yeah, a lot of people can get by with any of these models.

235
00:22:32,000 --> 00:22:37,400
And in some cases, these models are really well tuned for the exact business need that's there.

236
00:22:37,540 --> 00:22:39,920
So, you know, that's actually a good thing, right?

237
00:22:40,240 --> 00:22:42,160
That's something that they all have in common.

238
00:22:42,160 --> 00:22:44,680
They also have another thing in common.

239
00:22:45,780 --> 00:22:47,460
All of these styles fail.

240
00:22:47,860 --> 00:22:56,440
They all break down at some point, depending on actually what's going on in the company, depending on actually what's going on in the ecosystem.

241
00:22:56,460 --> 00:23:16,600
So if you are in a more traditional organization that's actually practicing a more regimented style of security and AppSec, what happens when you get a new VP of engineering or a new CTA that wants to be more agile and is hiring like really aggressive developers and wants to move to a style where there's kind of like continuous delivery?

242
00:23:17,760 --> 00:23:21,160
That traditional security team just kind of breaks.

243
00:23:21,700 --> 00:23:34,580
When you think about this DevSecOps style slash agile style, what happens when these companies do get much bigger and they are heavily regulated and they now have to have a lot more process?

244
00:23:34,580 --> 00:23:37,040
How do you keep your AppSec people more engaged?

245
00:23:37,040 --> 00:23:41,980
How do you actually deal with the bureaucracy that is now being forced down on you?

246
00:23:41,980 --> 00:23:48,340
On the pleading and parasite, it fails because, yeah, eventually something might go wrong.

247
00:23:49,120 --> 00:23:53,320
So what do we need to do about this?

248
00:23:53,560 --> 00:24:08,000
One of the things that has to recognize is that we as application security practitioners, we need to change based on the circumstances of what's going on in the company that we're in or the company that we may be joining.

249
00:24:08,080 --> 00:24:17,720
So for me, I could not use the same style of application security that I practiced at a bank when I moved to a company like Twilio.

250
00:24:17,720 --> 00:24:19,800
That's extremely agile, right?

251
00:24:20,560 --> 00:24:31,700
You know, when I was just a lowly engineer working in a meteorology center, that style of kind of like the, you know, plead and pray methodology.

252
00:24:31,720 --> 00:24:35,440
Yeah, I can't use that inside of a bank where it's heavily regulated.

253
00:24:35,440 --> 00:24:37,260
You know, the world is constantly changing.

254
00:24:37,260 --> 00:24:38,960
Threats are constantly changing.

255
00:24:39,100 --> 00:24:43,160
Where I go in my career and where you may go in your career is going to change.

256
00:24:43,160 --> 00:24:47,800
And what that means is that if you're too dogmatic, you will ultimately fail.

257
00:24:48,540 --> 00:24:53,300
As I mentioned, you also have to take into account who your adversaries are.

258
00:24:53,300 --> 00:25:14,460
You have to recognize that some of the things that are structured for a heavily regulated company and who they believe that they are, you know, targets from like organized crime, et cetera, how those adversaries operate might be very different than how an adversary might operate for a social media company or some other quote unquote Silicon Valley style company.

259
00:25:14,460 --> 00:25:21,300
And so you need to be aware of that when you are designing and building and practicing application security inside these companies.

260
00:25:21,300 --> 00:25:29,360
The other thing to take into account is that even though you might understand your adversary today, your adversary is always changing.

261
00:25:31,840 --> 00:25:45,740
So one of the things that I think we have to come back to and one of the things I want to borrow and I have borrowed from Bruce Lee is this idea of focusing on realistic fights or essentially realistic scenarios, right?

262
00:25:45,740 --> 00:25:52,440
You need to base your APSEC program on the actual likely threats and not make some of the mistakes I've seen in the past.

263
00:25:52,540 --> 00:26:05,900
It's really common to go into an organization and see that, oh, they're practicing traditional APSEC, heavily regimented, and they're giving embedded C programmers OWASP top 10 security training.

264
00:26:05,900 --> 00:26:07,860
That makes no sense at all, right?

265
00:26:07,860 --> 00:26:11,280
You need to actually modify based on what the company is looking like.

266
00:26:11,280 --> 00:26:17,940
You need to also regularly review and adjust those threat models, because as I said, your adversaries are changing, your infrastructure is changing.

267
00:26:17,940 --> 00:26:21,100
The world around you is not static.

268
00:26:21,100 --> 00:26:30,040
So these static, dogmatic styles of application security also need to change as well.

269
00:26:30,040 --> 00:26:32,480
And don't make any mistake about it.

270
00:26:32,480 --> 00:26:38,520
All of the styles are dogmatic, even the ones that claim to be agile.

271
00:26:38,520 --> 00:26:48,360
Some of the things that I think are useful inside of organizations is going back and really understanding the past, getting a better understanding of where vulnerabilities have happened previously.

272
00:26:48,420 --> 00:26:57,500
So you can actually start really getting engaged of what's important to the company, to the customers and how you commonly make mistakes, because those are the realistic fights that you've been in.

273
00:26:57,500 --> 00:26:59,760
And so that's what you need to practice for.

274
00:26:59,760 --> 00:27:02,820
And you also need to go back and actually say, like, well, what is it we really own?

275
00:27:02,820 --> 00:27:07,780
What are the key assets here and what kind of adversaries are going to be attracted to that?

276
00:27:07,780 --> 00:27:13,260
I mean, you can probably have a good idea of who your adversaries might be if you are moving billions of dollars a day.

277
00:27:13,260 --> 00:27:19,920
You may not understand who your adversaries are going to be if you're running social media or if you just have a cat picture website or those kind of things.

278
00:27:20,700 --> 00:27:25,700
Even though this is DEF CON and there's a lot of interesting talks, definitely go check them out.

279
00:27:25,700 --> 00:27:39,120
Don't let the zero days distract you too much, because often what's going to impact you are the 90, 180, the 365 day vulnerabilities that you haven't fixed yet.

280
00:27:41,420 --> 00:27:53,240
The other thing I really like about Jeet Kune Do is that Bruce Lee really wanted to focus on the outcome of a fight, the actual intent, and the intent is to end the fight.

281
00:27:53,240 --> 00:27:59,780
For us as application security practitioners, the intent is to provide secure outcomes.

282
00:27:59,780 --> 00:28:03,860
And you should do that with the least amount of energy and the most direct path.

283
00:28:03,860 --> 00:28:08,320
An interesting thing about Jeet Kune Do is that Bruce Lee introduced things like groin strikes.

284
00:28:08,320 --> 00:28:11,420
He introduced eye pokes because he's like, hey, I want to end the fight.

285
00:28:11,420 --> 00:28:18,540
I don't need to care about what's the proper way or what is the dogmatic way or what the proper style is.

286
00:28:18,540 --> 00:28:23,560
And that means that you should be very open to using whatever tool is the most sufficient.

287
00:28:23,560 --> 00:28:30,420
So if pen testing gives you quick results, that gives a lot of value for you and you can actually fix security issues, use that.

288
00:28:30,420 --> 00:28:34,240
If static analysis gives you better results, use that.

289
00:28:34,240 --> 00:28:39,460
People are going to harass me about this later, especially those that know me personally.

290
00:28:40,100 --> 00:28:42,440
It hurts to even say this.

291
00:28:42,720 --> 00:28:48,280
If a WAF will help you solve security problems, you should use a WAF.

292
00:28:49,560 --> 00:28:52,240
I just I need a break.

293
00:28:53,000 --> 00:28:56,480
Even security unicorn here doesn't believe I just said that.

294
00:28:56,720 --> 00:28:58,500
But it is true, right?

295
00:28:58,500 --> 00:29:10,180
Because you need to get rid of ego, even my ego, and focus on the real goal, which is secure outcomes, not the practice, the outcome.

296
00:29:10,200 --> 00:29:11,240
That's what we want.

297
00:29:11,240 --> 00:29:14,140
We want secure outcomes, not security practices.

298
00:29:14,140 --> 00:29:21,720
Some good security practices can lead to secure outcomes, but you should not heavily index on that.

299
00:29:23,520 --> 00:29:31,900
You also need to make sure that you and your application security team are also continually preparing, continually conditioning.

300
00:29:31,980 --> 00:29:40,360
Bruce Lee believed heavily that you should always be ready and training for a fight because you don't know when it's going to occur and you don't know what it's going to look like.

301
00:29:40,360 --> 00:29:49,180
And if you're not practicing some of the fundamentals and if you're not practicing being ready, then you will always be on your back foot, which sets you up for failure.

302
00:29:49,180 --> 00:29:59,540
We have to remember that application security software itself, how we design and build software and infrastructure, is changing daily.

303
00:29:59,540 --> 00:30:05,980
And the things that you learned today or the things you learned five years ago may not actually be useful tomorrow.

304
00:30:05,980 --> 00:30:11,460
Now, there are some fundamentals and some principles and things like that that I do believe continue to be useful.

305
00:30:11,480 --> 00:30:15,340
Like I think threat modeling, that's just to me, it's just common sense.

306
00:30:15,340 --> 00:30:17,320
It's like, yeah, you should know who your opponent is.

307
00:30:17,320 --> 00:30:18,480
What is it you're training for?

308
00:30:18,480 --> 00:30:24,180
Or at least broadly, what kind of fight are you training for or kinds of fights?

309
00:30:24,180 --> 00:30:28,700
What does your environment look like and what are the things that you know that you could probably predict now?

310
00:30:29,380 --> 00:30:33,880
I, you know, obviously I have a static analysis background and just general code understanding background.

311
00:30:33,880 --> 00:30:38,140
So, yes, I still love analyzing code because it actually has so much return value for you.

312
00:30:38,140 --> 00:30:46,280
It allows you to really get a good indication about what's going on in your ecosystem and what are potential problems that may occur.

313
00:30:46,460 --> 00:30:49,020
This is, yeah, it's aka know yourself, right?

314
00:30:49,020 --> 00:30:51,800
If you don't know yourself, how can you actually know how to actually improve?

315
00:30:52,540 --> 00:31:00,040
Adversarial simulation in whatever format you want that to occur in, red team, pen testing, whatever, tabletop exercises.

316
00:31:00,040 --> 00:31:02,780
You want to constantly be training, constantly sparring.

317
00:31:02,780 --> 00:31:10,160
And then there's also probably one of the more important things in particular in application security, which is effective communication.

318
00:31:10,820 --> 00:31:21,460
Application security wins and fails by its ability to convey risk in a way that other people in the organization can understand.

319
00:31:21,460 --> 00:31:31,920
To bring them along in that journey, you actually have true allies that are going to be proactive, that can actually reach into all those places where you don't have enough time or don't have enough insight and understanding.

320
00:31:31,920 --> 00:31:34,640
Having allies in a fight is always a good thing.

321
00:31:34,640 --> 00:31:37,940
I don't understand anybody that wants to have a one-on-one fight.

322
00:31:38,840 --> 00:31:41,240
The idea of a fair fight is just dumb, right?

323
00:31:41,240 --> 00:31:44,380
You should always have an advantage by any means necessary.

324
00:31:44,640 --> 00:31:49,420
And the thing that you should remember is that these are the philosophies of your attackers, right?

325
00:31:49,420 --> 00:31:56,340
An attacker isn't going to say like, oh, well, this bank practices this traditional style of security.

326
00:31:56,340 --> 00:32:00,020
So I need to make sure that, you know, my attack matches that.

327
00:32:00,020 --> 00:32:01,020
No, no, they're not going to do that.

328
00:32:01,020 --> 00:32:06,780
They're going to use whatever is most efficient to get them the results that they want.

329
00:32:10,500 --> 00:32:26,740
An important thing that Bruce Lee believed was this idea that not only should he be teaching others, but he should be learning from others and learning from his students, because the people that we actually interact with in application security, regardless of where they come from,

330
00:32:26,740 --> 00:32:28,860
all have something that we can learn from.

331
00:32:28,920 --> 00:32:41,760
And when you're bringing people along on the journey, it can also help you refine your understanding of application security and find out where your gaps are, or maybe even be introduced to new concepts that you may have never even considered before.

332
00:32:42,600 --> 00:32:49,140
I, you know, obviously, you know, I'm not a big fan of some of the security gatekeeping that goes on, and I've been guilty of it myself.

333
00:32:49,140 --> 00:32:55,580
But what I have learned is that security comes in all shapes, forms, sizes and backgrounds.

334
00:32:55,580 --> 00:33:00,060
And you can have somebody that doesn't even have a programming background.

335
00:33:00,060 --> 00:33:02,920
That's a phenomenal application security practitioner.

336
00:33:02,920 --> 00:33:05,460
You can have somebody that was maybe just a network engineer.

337
00:33:05,460 --> 00:33:14,460
You can even have somebody that was working at a front desk at a company bringing significant value to an application security team.

338
00:33:15,040 --> 00:33:19,980
The gatekeeping bothers me also because everybody was a noob.

339
00:33:19,980 --> 00:33:23,940
There is nobody out there that was not a noob at some point.

340
00:33:23,940 --> 00:33:29,760
And anytime new technology is introduced, you're in that position again of being a newbie.

341
00:33:29,760 --> 00:33:31,820
So we just got to get rid of the egos, y'all.

342
00:33:32,440 --> 00:33:42,560
The more we can invest in broadening the ecosystem, the more we can invest in bringing more and more people along, the better our AppSec journey is going to be.

343
00:33:42,560 --> 00:33:43,900
Because we have more allies.

344
00:33:43,900 --> 00:33:45,380
We have more coverage.

345
00:33:45,380 --> 00:34:03,660
And you also get maybe a little bit of time back to maybe explore some of those zero day things that you're interested in that I previously said, you know, some of the things you can also take away from teaching others and bringing more people into application security is that when you understand everybody else's journey,

346
00:34:03,660 --> 00:34:06,380
you get to understand a little bit more about your own journey.

347
00:34:06,380 --> 00:34:16,120
And when you start listening to other people, you also learn more things you can incorporate into things like threat modeling, incorporating the things like abuse protection.

348
00:34:16,120 --> 00:34:20,960
Like we see this action in the world today with regards to some of the things like privacy, for example.

349
00:34:20,960 --> 00:34:34,840
At least anecdotally, I've noticed that teams that are more diverse actually have better attitudes around privacy because there are more opinions about how various features and functions impact people based on what their life is like.

350
00:34:34,840 --> 00:34:42,920
I know that me as a six foot one black male, I have a different threat profile than a five foot one woman.

351
00:34:42,920 --> 00:34:47,300
And what I want on the Internet or from an application may be different.

352
00:34:47,300 --> 00:34:54,540
Somebody may be in a an abusive relationship and they're worried about stalkers and that's a different profile.

353
00:34:54,540 --> 00:35:02,140
If you don't have people on the team that can bring those things to the table, then you're actually you're simply operating at a deficit.

354
00:35:02,460 --> 00:35:10,920
You really want to also make sure you're pushing yourself outside of your comfort zones and dipping into other areas of the business.

355
00:35:10,920 --> 00:35:22,420
As a good application security practitioner, the more you can learn about the business and more you can learn about your co-workers, the better you can actually serve your company and the better you can actually serve the ecosystem.

356
00:35:24,990 --> 00:35:33,350
Finally, one of the big things is really what I'm arguing for here is that AppSec needs to be flexible.

357
00:35:34,130 --> 00:35:43,790
If you practice just one style, if you are too dogmatic, then you will always be on the back foot and you won't be able to adjust to new threats in the landscape.

358
00:35:43,790 --> 00:35:47,050
You won't be able to adjust to new jobs.

359
00:35:47,150 --> 00:35:58,370
You will have a difficult time migrating from a heavily regulated industry to a slightly regulated industry or like a small startup, etc.

360
00:35:58,370 --> 00:36:03,650
And vice versa, if you're like a startup and you're like, hey, I'm all about agile and DevSecOps, etc.

361
00:36:03,790 --> 00:36:07,170
That is good at a startup in some cases.

362
00:36:07,190 --> 00:36:12,730
But when you go to a heavily regulated industry, you might run into a lot of friction and you might run into a lot of problems.

363
00:36:12,770 --> 00:36:20,490
So one of the other things that I think is useful for that flexibility is also understanding really what is important to you.

364
00:36:21,590 --> 00:36:24,990
People are probably going to be a little bit unhappy about this.

365
00:36:24,990 --> 00:36:32,330
Be flexible about where you actually want to invest your security resources and your security care.

366
00:36:32,590 --> 00:36:46,130
Occasionally, that means like, yeah, you might want to tell a developer that it's OK to do a release without a full security review because really the developer is just adding an extra button on the website or an extra image on the website.

367
00:36:46,130 --> 00:36:57,670
And instead of delaying them with a 20, 40, 60, 80 hour application security static analysis scan, you're like, oh, just go ahead and ship it.

368
00:36:57,670 --> 00:36:58,630
Still be happy.

369
00:36:58,630 --> 00:36:59,750
You'll be happy.

370
00:36:59,750 --> 00:37:02,490
And ultimately, it allows you to actually get some goodwill.

371
00:37:02,490 --> 00:37:05,490
So you can also focus on the bigger problems.

372
00:37:05,490 --> 00:37:17,470
You also need to be aware that, yeah, you might have to be flexible, in particular if you're one of the more agile DevSecOps type operations, when new bureaucracy comes in.

373
00:37:17,470 --> 00:37:19,190
You might have additional regulations.

374
00:37:19,190 --> 00:37:21,310
We've experienced that in the recent future.

375
00:37:21,310 --> 00:37:25,510
I'm in California and CCPA is a recent and new regulation for us.

376
00:37:25,510 --> 00:37:27,610
A lot of people already experienced GDPR.

377
00:37:27,610 --> 00:37:29,530
It's a new and recent regulation.

378
00:37:29,630 --> 00:37:33,890
And it's not something that you were able to opt in or opt out of.

379
00:37:33,890 --> 00:37:43,450
As I mentioned, you should think a lot about being flexible to have compromises in some of the smaller security recommendations.

380
00:37:43,530 --> 00:37:51,710
So you can actually have resources to get focused on the bigger risk and the bigger security regulations and security concerns.

381
00:37:51,710 --> 00:38:08,270
So, for example, if you dump a static analysis scan in front of somebody that has 10,000 findings and you're like, oh, you need to fix every single one of those, you're going to quickly find yourself being walked out the door.

382
00:38:08,270 --> 00:38:11,210
But if you can get them to actually focus on, hey, you know, this is actually really important.

383
00:38:11,210 --> 00:38:14,430
These are the high critical vulnerabilities and there's only 10 of them.

384
00:38:14,430 --> 00:38:15,990
Please just focus on those.

385
00:38:16,010 --> 00:38:21,870
You get a lot more buy in and ultimately you really are reducing risk and reducing the significant risk.

386
00:38:21,870 --> 00:38:26,750
And that's really what we want to do as application security practitioners.

387
00:38:33,610 --> 00:38:37,850
So there is no singular way to practice AppSec.

388
00:38:37,850 --> 00:38:41,530
There is value to be had in multiple approaches.

389
00:38:41,530 --> 00:38:46,030
There are no single profiles that make good AppSec practitioners.

390
00:38:46,030 --> 00:38:49,250
Many perspectives and backgrounds are valuable.

391
00:38:49,250 --> 00:38:53,770
Your approach must match the immediate situation.

392
00:38:54,330 --> 00:38:59,090
Being rigid in AppSec does not work.

393
00:39:07,560 --> 00:39:09,900
I said empty your mind.

394
00:39:10,720 --> 00:39:14,960
Be formless, shapeless, like water.

395
00:39:15,540 --> 00:39:19,680
Now you put water into a cup, it becomes the cup.

396
00:39:19,680 --> 00:39:22,000
You put water into a bottle, it becomes the bottle.

397
00:39:22,000 --> 00:39:25,220
You put it in a teapot, it becomes the teapot.

398
00:39:25,260 --> 00:39:28,660
Now water can flow or it can crash.

399
00:39:29,440 --> 00:39:31,200
Be water, my friend.

400
00:39:31,880 --> 00:39:35,460
So thank you for taking a little bit of your time out today.

401
00:39:35,460 --> 00:39:40,360
I'm really, really, really looking forward to interacting with some of you online.

402
00:39:40,380 --> 00:39:42,480
Hopefully answering some questions.

403
00:39:42,560 --> 00:39:45,400
Hopefully maybe even being challenged about some of the things that I said.

404
00:39:45,400 --> 00:39:49,440
As I mentioned, I can't teach you anything.

405
00:39:49,440 --> 00:39:52,640
I can tell you about my opinions and about my journey.

406
00:39:52,640 --> 00:40:02,440
But I would be even more hypocritical than I already am if I told you that I have the answers to this and that there's one particular way that you need to practice AppSec.

407
00:40:02,440 --> 00:40:04,360
Be like water.

408
00:40:04,360 --> 00:40:06,360
Adjust to your environment.

409
00:40:06,560 --> 00:40:15,920
Fill the container that you will be poured into and give the security that you really, really want to deliver to others.

410
00:40:15,920 --> 00:40:17,360
Thank you so much.

411
00:40:17,360 --> 00:40:25,560
I really, really, really do appreciate having the opportunity to speak to you and for those of you that even made it to the end of this talk.