start	end	text
13000	17300	Welcome to Day 2 of AppSec Village. I am your queen, Leora Herman.
17860	20540	You might notice that I am sans tiara this year.
20720	23260	That bling is saved for in-person occasions.
23740	29020	I hope you enjoyed yesterday and are geared up for another great day of fun in AppSec.
29080	33280	Speaking of gear, I am inserting a shameless plug for AppSec gear.
33280	38040	If you go to appsecvillage.com and click on shop, you can get your own village merch,
38040	40660	which helps support our volunteer-run village.
40660	43160	Okay, plug for merch over.
43720	45760	No village is without its challenges,
45760	51160	and I'm still not quite sure how lockpicking village is managing in safe mode.
51760	54820	So, no village is without its challenges,
54820	58160	and year 2 of AppSec Village brought with it its own set.
58520	63460	With DEF CON going virtual, all of our combined superpowers were needed to pull this off.
63460	67860	We really appreciate your patience and the cooperation of our speakers and volunteers
67860	70020	as we worked things out.
70020	74220	It has not been smooth sailing, but we made it.
74300	79300	If you were with us last year, you heard how much we value the diversity of our community.
79920	83260	I'm not just talking about race, religion, or political views,
83560	86240	but diversity in sexuality and gender identity,
86560	90180	level of formal education, and security experience.
90700	93500	Talking about diversity is just words,
93500	96040	and what are words without actions?
96220	99280	We must actively embody our ideals every day.
99280	104640	And as you can see from this year's leadership, our keynotes, and the speaker lineup,
104640	106660	we have put our words into actions.
106760	110100	And our first talk for today is certainly action-packed,
110100	112980	kicking off day 2 as Frederick Flea Lee.
113080	114840	Flea is the CISO at Gusto,
114840	119100	the people platform that enables 100,000 plus small businesses nationwide
119100	123180	to pay, insure, and provide benefits for their teams.
123640	126300	Flea previously headed up information security at Square
126300	131120	and held senior security roles at Bank of America, Twilio, and NetSuite.
131320	133620	His keynote is Be Like Water,
133620	136140	what Bruce Lee can teach us about AppSec.
136140	139570	Please join me in welcoming Flea to the virtual stage.
140500	143180	As of the recording of this talk,
143180	146600	the killers of Breonna Taylor have not been charged.
153920	157140	Hey everybody, welcome to my keynote,
157140	163040	and welcome to DEF CON Day 2 AppSec Village.
163040	165140	I'm super excited to be here.
165140	170560	I noticed definitely, definitely, definitely unusual circumstances.
171300	176380	Bruce Lee and how I believe he relates to application security
176380	179800	and some of the things that we can actually learn from him.
179900	182900	Obviously, there's a couple of things, you know, kind of get out of the way,
182900	184140	which is introductions.
184140	186720	As I said, my name is Frederick Lee.
186720	189540	Most people call me Flea.
189560	192840	And I want to talk to you, you know, about what I do.
192840	195800	I'm currently the CISO of a company called Gusto.
195800	198360	We're actually focused on building a people platform
198360	202620	that enables small and medium sized businesses to kind of give their employees
202620	207260	all those things that, you know, one would want to have a delightful work experience.
207260	209380	Gusto is not the only place I've worked at, right?
209380	214020	I mean, I've also, you know, led security at Square, a fintech company.
214480	216820	You know, I led security at NetSuite.
216820	218620	You had a SaaS company.
218620	220040	I was at Twilio.
220380	222260	I was also at Betfair.
222260	224660	So for those of you, you know, fricket gamblers, et cetera,
224660	226900	you might remember that name.
227340	231880	Fortify, many, many moons ago, and even Bank of America.
232100	236820	Those are all just like random companies, all random and all really, really different.
236820	239680	And I've had numerous different roles over the years.
239680	242580	Like I started my career as a software developer.
242580	244520	I'm just writing code like a lot of you.
244520	248840	But I've also spent time being a sysadmin, including, you know,
248840	253820	like crawling through spaces and running cables, et cetera.
254200	256440	You know, it's a really, really fulfilling job.
256440	258720	I took that and then I decided, hey, you know what?
258720	262960	I want to actually spend more time going back to my roots as a security researcher,
262960	265980	practicing security in various different places.
265980	270800	And I've been fortunate enough to actually be on several different world class security teams.
270800	275840	And I've also been fortunate enough to become a security leader,
275840	282640	both as just a direct line manager, director, and ultimately, you know, a couple of stints as being a CISO.
282680	287880	With all those things said, you know, similar to my previous experience at other companies,
287880	290860	all those roles are also different.
291280	295020	But really, none of that should matter. Right?
295020	298920	We always do these things in slides, in particular in keynotes, et cetera.
298920	309300	Like, oh, let me tell you a little bit about my history with the idea that somehow me having experience being more mature,
309300	313860	we just put it that way, and having several decades under my belt,
313860	320480	it's somehow meaning that I have something to teach you or that you should be paying attention to me,
320480	326260	that you should view people such as myself as, quote unquote, thought leaders.
326600	330440	But really, you don't care about my background. Hopefully you don't.
330780	334580	Hopefully you're really here because like me, you hear more about Bruce.
334580	345100	Bruce Lee is one of my idols and somebody I look up to both as just a good human being and some of the phenomenal things that he's actually done throughout his life.
345100	349220	And also as a philosopher and some of the things that we can take away from that.
349220	354380	So for those of you that aren't familiar with Bruce Lee, he's a native San Franciscan.
354380	361820	A lot of people actually don't know that, you know, probably his big claim to fame is all of the martial arts movies that he's been in.
361820	367120	You know, Big Boss, Enter the Dragon, which, you know, obviously everybody knows.
367260	374600	But some of the other things I think people forget about, it's like a lot of the work that he's done just in general to make the world a better place.
374600	379300	He was instrumental in breaking down lots and lots of stereotypes.
379300	385220	So like stereotypes around like Asians in Hollywood and just Asians in society in general.
385220	399400	Like he made it OK slash essentially effectively broke through to have strong leading roles for Asians and strong leading roles, particularly for Asian men.
399400	406060	But he did even more outside of his Hollywood career because he was a world class martial artist.
406060	418000	And he was a big proponent not only of practicing martial arts, but making martial arts available to everybody, regardless of your race, gender, body style, etc.
418000	423220	He pushed back on the belief that there was only one type of person.
423220	430660	And he also pushed back on the belief that there's only one style of martial arts that was suitable for all things.
430660	443120	He really was a Renaissance man. He believed in constantly learning and constantly growing, studying everything from boxing to ballet, even philosophy.
443940	451620	He's also known for beating up Wong Jack Man, a Kung Fu practitioner in Oakland.
452060	467200	And what was interesting about this situation was that it was related to Bruce Lee's desire to make sure that his learnings and his philosophy and just the advantages of martial arts were available to all people.
467200	478540	At a time when a lot of people felt that martial arts, in particular Kung Fu, should only be taught to Chinese people and should not be available to other races.
478540	484420	I love this quote that actually recounts Bruce Lee's perspective on the fight. And I'll just read it for you.
484420	490740	I'd gotten into a fight in San Francisco with a Kung Fu cat. And after a brief encounter, the son of a bitch started to run.
490740	499400	I chased him and, like a fool, kept plunging him behind his head and back. Soon, my fists began to swell from hitting his hard head.
499480	506880	Right then, I realized Wing Chun was not too practical and began to alter my way of fighting.
506880	514800	This really was kind of like the birth and the inspiration of Bruce Lee to start seeking out better ways to practice martial arts.
514800	526860	And ultimately, Lin, you know, lent his way towards creating Jeet Kune Do, a form and his philosophy of martial arts, which essentially means the way of an intercepting fist.
528040	534140	Bruce Lee is probably the first true, quote unquote, mixed martial artist.
534140	537220	He described his style as hybrid fighting.
538500	542760	So Jeet Kune Do, what exactly is it? What is it about, etc.?
542760	558720	One of the key principles of Jeet Kune Do is that it's focused on the outcome of a fight, not just the kata, not just practices, not just forms, but really the ultimate goal, which is to essentially stop the fight.
558720	572660	He wanted to make sure that his form of martial arts and his philosophy got rid of the dogma, that it allowed you to leverage all the techniques across a wide gamut of martial arts.
572740	582160	He also wanted to make sure that when he was training and that his students were training, that they were actually training for realistic scenarios, not just sparring matches and not just Kung Fu competitions.
582160	587300	He felt that you needed to be constantly preparing yourself and constantly conditioning yourself.
587300	596220	And that with that combination of letting go of dogma and constant preparation, you could ultimately get to a fluid state.
596220	599980	So you're always prepared without being stressed.
599980	606860	He was a permanent student and he believes that all people should always be learning.
606860	619320	I love this quote by him and I think there's so much for us to take away from it, which is absorb what is useful, reject what is useless, add what is essentially your own.
621300	632700	I have not invented a new style, composite, modified or otherwise, that is set within distinct form as apart from this method or that method.
632700	639700	On the contrary, I hope to free my followers from clinging to styles, patterns or molds.
640260	643180	So what does this have to do with APSEC?
643180	647300	I understand you. This seems like a really, really drawn out analogy.
647360	650880	I promise you that there is something here.
651840	659840	I believe that APSEC has actually fallen into a lot of the same traps that previous martial arts practitioners had.
659840	664840	There was always this idea that, oh, my style is superior to your style.
664840	668460	I'm going to go to your dojo and challenge your master, etc.
668460	672980	And we have a lot of those same tendencies inside of security.
672980	676580	Instead of senseis, we have thought leaders.
678340	680920	I'm OK with that actually being an insult.
680920	688420	I've been called that myself and I've probably been guilty of perpetuating some of the same problems that these thought leaders are doing.
688420	691120	We are heavily relied upon dogma.
691120	696000	There are some people like, oh, if you're not practicing DevSecOps, then you're not really practicing APSEC.
696000	698060	Your security program isn't going to work.
698060	702940	There are others that believe like, oh, you need to be following something that's from NIST.
702940	705620	And that's how application security is supposed to be approached.
706400	711440	Often we've kind of forgotten what the real point of application security is.
711440	720120	When Jeet Kune Do, Bruce Lee thinks about this concept of, hey, the true purpose is to end the fight.
720120	727780	Inside of application security, our true purpose is to actually create and have secure outcomes.
727860	732100	Another issue that we have in application security is that we often get distracted, right?
732100	735040	We're distracted by whatever the latest zero day is.
735040	742400	Instead of actually really thinking about the common threads, like in Jeet Kune Do, Bruce Lee wanted people to focus on realistic fighting,
742400	748260	not just these outliers and things like that, the things you're going to come across on a day to day basis.
749200	751960	Also, we have similar problems with gatekeeping.
752700	757600	You know, there's a lot more we can actually be doing to actually bring more people into application security.
757880	762680	But we've always kind of perpetuated this myth, either intentionally or unintentionally,
762680	766920	that AppSec is only for these blessed few and they have to look a certain way.
766920	772100	They had to, you know, belong to certain crews and cliques or they had to have gone to a certain school.
772420	780700	Ultimately, we've latched onto these ideas so hard and we've been so inflexible that we're really like a rock.
781640	784740	Instead, we must be like water.
786920	790300	So let's actually talk about Jeet Kune Do for AppSec.
791700	795960	I want to start a little bit actually talking about the styles of AppSec.
795960	799380	Right. There is the traditional style.
799500	804160	And I think, you know, in particularly some of you that are older or maybe actually work in a large organization,
804160	809500	you might actually be familiar with this. Generally, the traditional style is guided by compliance.
809500	813840	Hey, what are the regulations? What are the things we have to do to check the box?
813940	817920	It's heavily focused on testing and auditing.
817920	826260	It works really, really well with more traditional SDLCs, like companies that are releasing software once or twice a year,
826260	829660	probably still practicing a waterfall type methodology.
829660	833760	Like I said, it's really, really common in large corporations.
833800	839600	And because of that, they're often just focused on buying tools like, hey, let me go get a license for Fortify.
839600	846140	Let me go get a really expensive license for some dynamic testing suite, etc.
846140	849460	But there actually are a lot of good things about this style.
849460	852560	Like one, it actually is predictable and repeatable. Right.
852600	861140	And it's great because nobody is surprised by what is expected and what is going to happen when the application security team engages with them.
861140	866260	You produce a lot of artifacts and a lot of evidence. That sounds like a lot of paperwork.
866300	875540	But in particular, in heavily regulated industries, that is great when you have to deal with auditors because auditors actually understand it and it makes them happy.
875540	880740	It allows for a lot of control over development and over the developers.
880920	888960	And it makes executives at these large corporations really, really comfortable because they can always go back and say, look, we followed the best practices.
888960	894540	We're doing what all the other large corporations are doing. Look at how rigid and in control we are.
894720	900040	And that gives them a lot of comfort. It also is kind of a good way to have some deniability.
900740	909740	One other good thing about it is because of this really, really aggressive, maybe oppressive, pops down style, is that it makes it really easy to have mandatory developer training.
909740	921840	And I think everybody believes that when developers know more about security and developing good, secure software, they generally have fewer security vulnerabilities.
922120	928240	Obviously, this isn't perfect. There's a reason why tons of people no longer use this methodology.
928240	933940	One, it slows down developers. And that can definitely have an impact on your competitive advantage.
934000	938640	It over, over, over indexes on compliance and process, etc.
938640	947160	And oftentimes people and companies forget about addressing true risk because they're so worried about checking boxes.
947860	951440	These are the kind of situations where you have to have a large AppSec team.
951440	961080	There's no way that you can actually do these many reviews, do this much process with a 4, 5, 10, even a 15-person AppSec team.
961140	969580	The other big thing is that that part that the execs like, that deniability aspect, it's not the same as actually being secure.
969620	975440	Yes, just because you won't get carted away to jail when you're in front of Congress, etc. after your breach,
975440	982840	it doesn't mean that you actually did the right thing by your customers and by the rest of the ecosystem that relies upon you.
982860	986400	Another thing is that it also kind of separates the security team from the developers.
986560	996680	And oftentimes the security team doesn't really understand the code base or the product because they're really focused on trying to just find holes and go through a process.
997000	1001600	And that can also lead towards a lot of conflict with developers.
1001600	1006420	And finally, at least personally, I find this style to be soul crushing.
1006940	1012400	You know, this is part of my job when I was at Bank of America, and it really can be confining.
1012400	1019060	And also having that antagonistic relationship as somebody who identifies as an engineer just isn't fun.
1020260	1030000	What a lot of people actually practice now is kind of like this DevSecOps, DevOps, you know, whatever acronyms you want to use, security engineering, etc.
1030000	1033840	This more agile application security type practice.
1033840	1038220	It's a great thing in the aspect that it really is heavily guided by engineering.
1038400	1046200	And that's really, really good. Having an application security team that is our engineers and can relate to engineers just pays dividends.
1046500	1050440	The security team is there to actually just, you know, kind of like you write code and design systems.
1050440	1061700	They really are about building golden paths, building safe defaults, other things that actually just make a developer's life much easier because the developer doesn't have to worry about security as much.
1061700	1076540	I was often also focused heavily on this idea that if you can build the right golden path, then the developers can actually have a lot more freedom to exercise their creativity and actually launch interesting and good products.
1076540	1084800	You see this style very much in startups or probably the best way to describe it is Silicon Valley style technology companies.
1084860	1088240	But I love the fact that it does have this engineering first focus.
1088440	1092740	You know, it's like I said, it's a lot of good that comes out of this because code scales.
1092740	1101260	And what that means is you can also have a really, really lean security team and they can move kind of close to the developer speed.
1101260	1107560	You can get a really, really good understanding of the code and what the actual product goals are by the security team.
1107560	1113500	And that allows the AppSec team to really make pragmatic choices in some of the things that they're building.
1113600	1120480	And also they're more focused on preventative measures as opposed to just purely detective measures, which is more like the traditional style.
1120960	1123980	As much as I love this style, it isn't perfect either.
1123980	1130500	Like one of the big things is that oftentimes because there's not a huge paper trail or a lot of things are actually more innovative,
1130500	1137540	it's hard for external regulators to understand. And that can lead to gaps and potential issues and sometimes even fines.
1139060	1143120	Because often these security teams are really, really lean.
1143560	1150780	You can find yourself in a scenario where even if you have a lot of high caliber security engineers, they still get overwhelmed by the developers.
1150780	1156500	In general, the broader development team is still going to be larger than your AppSec team.
1156500	1162780	And then finally, when I put my pointy-haired hat on or pointy-haired boss hat on or whatever,
1163420	1169860	it's difficult to actually find really, really good AppSec engineers that can code, understand security,
1169860	1177980	understand how to actually build things that make developers easier. And those AppSec engineers tend to be a little bit more expensive.
1178780	1185800	There's another style, though, that I find interesting, and I think a lot of you have probably been there before or at least know people that are there,
1185800	1193700	which is a style called the pleading and prayer style. And this is generally characterized by a company that's more guided by cost.
1193700	1200720	These generally tend to be smaller companies, maybe like a really, really small startup, like maybe less than 10 people.
1200720	1204140	Like they're not they don't think they're ready yet for a security team.
1204140	1213420	And also some companies that don't consider themselves technology companies, like maybe it's an architectural firm or a law firm or maybe it is a financial institution.
1213420	1220540	And so they don't really think they deal with software. They don't think that they have application security type problems.
1220820	1225100	You know, they don't think they're regulated. So there's no external pressure on them as well.
1225100	1231600	And when security needs do arise, they rely more on this kind of like volunteer firefighter department type method.
1231600	1235660	One of the good aspects of one of the things that makes it attractive about it is that it's cheap, right?
1235680	1240200	You're not paying for security people. It's cheap, right?
1240200	1248620	Less headcount. You're not buying tools. All these are the kind of things that can pile up that can seem like costs that are unnecessary because, you know,
1248620	1253660	security can appear to be invisible unless something goes wrong.
1253940	1257260	Ultimately, you know, statistics actually kind of on their side.
1257260	1262060	But the reality is, is that most companies don't have a significant breach.
1263340	1266260	There are definitely bad aspects of this, though, right?
1266260	1270580	You know, literally you get what you pay for. I've told people this time and time again.
1270780	1273840	Cheap security is generally expensive security, right?
1274540	1277340	Statistics are on your side until they are not, right?
1277340	1282460	When you roll the dice the wrong time, that one time it can be dramatically consequential.
1282620	1286680	And when you don't have an AppSec team, you now find yourself in a bind.
1286680	1292620	A lot of these companies forget that they are still utilizing software or writing software,
1292620	1298320	even if it's a tiny amount that can still have some impact to their business and ultimately to their customers.
1298860	1308820	No one in the company is even aware because no one in the company is focused on software security until something goes wrong.
1308820	1314700	You know, one of the things that I've learned long ago is that ultimately software is eating the world.
1314700	1322600	And that's what allows us to be so innovative. And that's also what allows us to have a virtual DEF CON here in COVID land.
1324720	1329240	One thing that you notice about this, though, is that all of these styles work.
1329240	1337200	They all work. As I mentioned, statistics kind of show that most companies don't get breached.
1337200	1346760	Now, I say they all work. That doesn't necessarily mean that they're all secure and that it delivers the same level of security and resilience as some of the other styles.
1346760	1352000	But the reality is, is that, yeah, a lot of people can get by with any of these models.
1352000	1357400	And in some cases, these models are really well tuned for the exact business need that's there.
1357540	1362160	So, you know, that's actually a good thing, right? That's something that they all have in common.
1362160	1367460	They also have another thing in common. All of these styles fail.
1367860	1376440	They all break down at some point, depending on actually what's going on in the company, depending on actually what's going on in the ecosystem.
1376460	1384260	So if you are in a more traditional organization that's actually practicing a more regimented style of security and AppSec,
1384260	1390900	what happens when you get a new VP of engineering or a new CTA that wants to be more agile and is hiring like really aggressive developers
1390900	1396600	and wants to move to a style where there's kind of like continuous delivery?
1397760	1405040	That traditional security team just kind of breaks. When you think about this DevSecOps style slash agile style,
1405040	1414580	what happens when these companies do get much bigger and they are heavily regulated and they now have to have a lot more process?
1414580	1417040	How do you keep your AppSec people more engaged?
1417040	1421980	How do you actually deal with the bureaucracy that is now being forced down on you?
1421980	1428340	On the pleading and parasite, it fails because, yeah, eventually something might go wrong.
1429120	1433320	So what do we need to do about this?
1433560	1438780	One of the things that has to recognize is that we as application security practitioners,
1438780	1445260	we need to change based on the circumstances of what's going on in the company that we're in
1445260	1450700	or the company that we may be joining. So for me,
1450700	1457720	I could not use the same style of application security that I practiced at a bank when I moved to a company like Twilio.
1457720	1466560	That's extremely agile, right? You know, when I was just a lowly engineer working in a meteorology center,
1467040	1471700	that style of kind of like the, you know, plead and pray methodology.
1471720	1477260	Yeah, I can't use that inside of a bank where it's heavily regulated. You know, the world is constantly changing.
1477260	1483160	Threats are constantly changing. Where I go in my career and where you may go in your career is going to change.
1483160	1487800	And what that means is that if you're too dogmatic, you will ultimately fail.
1488540	1493300	As I mentioned, you also have to take into account who your adversaries are.
1493300	1500760	You have to recognize that some of the things that are structured for a heavily regulated company and who they believe that they are,
1500760	1504080	you know, targets from like organized crime, et cetera,
1504080	1509060	how those adversaries operate might be very different than how an adversary might operate
1509060	1514460	for a social media company or some other quote unquote Silicon Valley style company.
1514460	1521300	And so you need to be aware of that when you are designing and building and practicing application security inside these companies.
1521300	1529360	The other thing to take into account is that even though you might understand your adversary today, your adversary is always changing.
1531840	1538740	So one of the things that I think we have to come back to and one of the things I want to borrow and I have borrowed from Bruce Lee
1538740	1545740	is this idea of focusing on realistic fights or essentially realistic scenarios, right?
1545740	1552440	You need to base your APSEC program on the actual likely threats and not make some of the mistakes I've seen in the past.
1552540	1560600	It's really common to go into an organization and see that, oh, they're practicing traditional APSEC, heavily regimented,
1560600	1565900	and they're giving embedded C programmers OWASP top 10 security training.
1565900	1571280	That makes no sense at all, right? You need to actually modify based on what the company is looking like.
1571280	1577940	You need to also regularly review and adjust those threat models, because as I said, your adversaries are changing, your infrastructure is changing.
1577940	1590040	The world around you is not static. So these static, dogmatic styles of application security also need to change as well.
1590040	1598520	And don't make any mistake about it. All of the styles are dogmatic, even the ones that claim to be agile.
1598520	1603640	Some of the things that I think are useful inside of organizations is going back and really understanding the past,
1603640	1608360	getting a better understanding of where vulnerabilities have happened previously.
1608420	1614980	So you can actually start really getting engaged of what's important to the company, to the customers and how you commonly make mistakes,
1614980	1619760	because those are the realistic fights that you've been in. And so that's what you need to practice for.
1619760	1622820	And you also need to go back and actually say, like, well, what is it we really own?
1622820	1627780	What are the key assets here and what kind of adversaries are going to be attracted to that?
1627780	1633260	I mean, you can probably have a good idea of who your adversaries might be if you are moving billions of dollars a day.
1633260	1639920	You may not understand who your adversaries are going to be if you're running social media or if you just have a cat picture website or those kind of things.
1640700	1645700	Even though this is DEF CON and there's a lot of interesting talks, definitely go check them out.
1645700	1659120	Don't let the zero days distract you too much, because often what's going to impact you are the 90, 180, the 365 day vulnerabilities that you haven't fixed yet.
1661420	1673240	The other thing I really like about Jeet Kune Do is that Bruce Lee really wanted to focus on the outcome of a fight, the actual intent, and the intent is to end the fight.
1673240	1679780	For us as application security practitioners, the intent is to provide secure outcomes.
1679780	1683860	And you should do that with the least amount of energy and the most direct path.
1683860	1688320	An interesting thing about Jeet Kune Do is that Bruce Lee introduced things like groin strikes.
1688320	1691420	He introduced eye pokes because he's like, hey, I want to end the fight.
1691420	1698540	I don't need to care about what's the proper way or what is the dogmatic way or what the proper style is.
1698540	1703560	And that means that you should be very open to using whatever tool is the most sufficient.
1703560	1710420	So if pen testing gives you quick results, that gives a lot of value for you and you can actually fix security issues, use that.
1710420	1714240	If static analysis gives you better results, use that.
1714240	1719460	People are going to harass me about this later, especially those that know me personally.
1720100	1722440	It hurts to even say this.
1722720	1728280	If a WAF will help you solve security problems, you should use a WAF.
1729560	1732240	I just I need a break.
1733000	1736480	Even security unicorn here doesn't believe I just said that.
1736720	1750180	But it is true, right? Because you need to get rid of ego, even my ego, and focus on the real goal, which is secure outcomes, not the practice, the outcome.
1750200	1754140	That's what we want. We want secure outcomes, not security practices.
1754140	1761720	Some good security practices can lead to secure outcomes, but you should not heavily index on that.
1763520	1771900	You also need to make sure that you and your application security team are also continually preparing, continually conditioning.
1771980	1780360	Bruce Lee believed heavily that you should always be ready and training for a fight because you don't know when it's going to occur and you don't know what it's going to look like.
1780360	1789180	And if you're not practicing some of the fundamentals and if you're not practicing being ready, then you will always be on your back foot, which sets you up for failure.
1789180	1799540	We have to remember that application security software itself, how we design and build software and infrastructure, is changing daily.
1799540	1805980	And the things that you learned today or the things you learned five years ago may not actually be useful tomorrow.
1805980	1811460	Now, there are some fundamentals and some principles and things like that that I do believe continue to be useful.
1811480	1815340	Like I think threat modeling, that's just to me, it's just common sense.
1815340	1818480	It's like, yeah, you should know who your opponent is. What is it you're training for?
1818480	1824180	Or at least broadly, what kind of fight are you training for or kinds of fights?
1824180	1828700	What does your environment look like and what are the things that you know that you could probably predict now?
1829380	1833880	I, you know, obviously I have a static analysis background and just general code understanding background.
1833880	1838140	So, yes, I still love analyzing code because it actually has so much return value for you.
1838140	1846280	It allows you to really get a good indication about what's going on in your ecosystem and what are potential problems that may occur.
1846460	1849020	This is, yeah, it's aka know yourself, right?
1849020	1851800	If you don't know yourself, how can you actually know how to actually improve?
1852540	1860040	Adversarial simulation in whatever format you want that to occur in, red team, pen testing, whatever, tabletop exercises.
1860040	1862780	You want to constantly be training, constantly sparring.
1862780	1870160	And then there's also probably one of the more important things in particular in application security, which is effective communication.
1870820	1881460	Application security wins and fails by its ability to convey risk in a way that other people in the organization can understand.
1881460	1885840	To bring them along in that journey, you actually have true allies that are going to be proactive,
1885840	1891920	that can actually reach into all those places where you don't have enough time or don't have enough insight and understanding.
1891920	1897940	Having allies in a fight is always a good thing. I don't understand anybody that wants to have a one-on-one fight.
1898840	1904380	The idea of a fair fight is just dumb, right? You should always have an advantage by any means necessary.
1904640	1909420	And the thing that you should remember is that these are the philosophies of your attackers, right?
1909420	1916340	An attacker isn't going to say like, oh, well, this bank practices this traditional style of security.
1916340	1920020	So I need to make sure that, you know, my attack matches that.
1920020	1926780	No, no, they're not going to do that. They're going to use whatever is most efficient to get them the results that they want.
1930500	1937360	An important thing that Bruce Lee believed was this idea that not only should he be teaching others,
1937360	1941060	but he should be learning from others and learning from his students,
1941060	1946740	because the people that we actually interact with in application security, regardless of where they come from,
1946740	1951140	all have something that we can learn from. And when you're bringing people along on the journey,
1951140	1957080	it can also help you refine your understanding of application security and find out where your gaps are,
1957080	1961760	or maybe even be introduced to new concepts that you may have never even considered before.
1962600	1969140	I, you know, obviously, you know, I'm not a big fan of some of the security gatekeeping that goes on, and I've been guilty of it myself.
1969140	1975580	But what I have learned is that security comes in all shapes, forms, sizes and backgrounds.
1975580	1980060	And you can have somebody that doesn't even have a programming background.
1980060	1985460	That's a phenomenal application security practitioner. You can have somebody that was maybe just a network engineer.
1985460	1994460	You can even have somebody that was working at a front desk at a company bringing significant value to an application security team.
1995040	1999980	The gatekeeping bothers me also because everybody was a noob.
1999980	2003940	There is nobody out there that was not a noob at some point.
2003940	2009760	And anytime new technology is introduced, you're in that position again of being a newbie.
2009760	2016160	So we just got to get rid of the egos, y'all. The more we can invest in broadening the ecosystem,
2016160	2022560	the more we can invest in bringing more and more people along, the better our AppSec journey is going to be.
2022560	2025380	Because we have more allies. We have more coverage.
2025380	2033920	And you also get maybe a little bit of time back to maybe explore some of those zero day things that you're interested in that I previously said,
2035000	2043660	you know, some of the things you can also take away from teaching others and bringing more people into application security is that when you understand everybody else's journey,
2043660	2048640	you get to understand a little bit more about your own journey. And when you start listening to other people,
2048640	2056120	you also learn more things you can incorporate into things like threat modeling, incorporating the things like abuse protection.
2056120	2060960	Like we see this action in the world today with regards to some of the things like privacy, for example.
2060960	2074840	At least anecdotally, I've noticed that teams that are more diverse actually have better attitudes around privacy because there are more opinions about how various features and functions impact people based on what their life is like.
2074840	2082920	I know that me as a six foot one black male, I have a different threat profile than a five foot one woman.
2082920	2087300	And what I want on the Internet or from an application may be different.
2087300	2094540	Somebody may be in a an abusive relationship and they're worried about stalkers and that's a different profile.
2094540	2102140	If you don't have people on the team that can bring those things to the table, then you're actually you're simply operating at a deficit.
2102460	2110920	You really want to also make sure you're pushing yourself outside of your comfort zones and dipping into other areas of the business.
2110920	2122420	As a good application security practitioner, the more you can learn about the business and more you can learn about your co-workers, the better you can actually serve your company and the better you can actually serve the ecosystem.
2124990	2133350	Finally, one of the big things is really what I'm arguing for here is that AppSec needs to be flexible.
2134130	2143790	If you practice just one style, if you are too dogmatic, then you will always be on the back foot and you won't be able to adjust to new threats in the landscape.
2143790	2158370	You won't be able to adjust to new jobs. You will have a difficult time migrating from a heavily regulated industry to a slightly regulated industry or like a small startup, etc.
2158370	2167170	And vice versa, if you're like a startup and you're like, hey, I'm all about agile and DevSecOps, etc. That is good at a startup in some cases.
2167190	2172730	But when you go to a heavily regulated industry, you might run into a lot of friction and you might run into a lot of problems.
2172770	2180490	So one of the other things that I think is useful for that flexibility is also understanding really what is important to you.
2181590	2184990	People are probably going to be a little bit unhappy about this.
2184990	2192330	Be flexible about where you actually want to invest your security resources and your security care.
2192590	2206130	Occasionally, that means like, yeah, you might want to tell a developer that it's OK to do a release without a full security review because really the developer is just adding an extra button on the website or an extra image on the website.
2206130	2217670	And instead of delaying them with a 20, 40, 60, 80 hour application security static analysis scan, you're like, oh, just go ahead and ship it.
2217670	2222490	Still be happy. You'll be happy. And ultimately, it allows you to actually get some goodwill.
2222490	2225490	So you can also focus on the bigger problems.
2225490	2237470	You also need to be aware that, yeah, you might have to be flexible, in particular if you're one of the more agile DevSecOps type operations, when new bureaucracy comes in.
2237470	2241310	You might have additional regulations. We've experienced that in the recent future.
2241310	2245510	I'm in California and CCPA is a recent and new regulation for us.
2245510	2249530	A lot of people already experienced GDPR. It's a new and recent regulation.
2249630	2253890	And it's not something that you were able to opt in or opt out of.
2253890	2263450	As I mentioned, you should think a lot about being flexible to have compromises in some of the smaller security recommendations.
2263530	2271710	So you can actually have resources to get focused on the bigger risk and the bigger security regulations and security concerns.
2271710	2283870	So, for example, if you dump a static analysis scan in front of somebody that has 10,000 findings and you're like, oh, you need to fix every single one of those,
2284710	2288270	you're going to quickly find yourself being walked out the door.
2288270	2291210	But if you can get them to actually focus on, hey, you know, this is actually really important.
2291210	2294430	These are the high critical vulnerabilities and there's only 10 of them.
2294430	2301870	Please just focus on those. You get a lot more buy in and ultimately you really are reducing risk and reducing the significant risk.
2301870	2306750	And that's really what we want to do as application security practitioners.
2313610	2317850	So there is no singular way to practice AppSec.
2317850	2321530	There is value to be had in multiple approaches.
2321530	2326030	There are no single profiles that make good AppSec practitioners.
2326030	2333770	Many perspectives and backgrounds are valuable. Your approach must match the immediate situation.
2334330	2339090	Being rigid in AppSec does not work.
2347560	2354960	I said empty your mind. Be formless, shapeless, like water.
2355540	2362000	Now you put water into a cup, it becomes the cup. You put water into a bottle, it becomes the bottle.
2362000	2365220	You put it in a teapot, it becomes the teapot.
2365260	2371200	Now water can flow or it can crash. Be water, my friend.
2371880	2375460	So thank you for taking a little bit of your time out today.
2375460	2380360	I'm really, really, really looking forward to interacting with some of you online.
2380380	2385400	Hopefully answering some questions. Hopefully maybe even being challenged about some of the things that I said.
2385400	2392640	As I mentioned, I can't teach you anything. I can tell you about my opinions and about my journey.
2392640	2402440	But I would be even more hypocritical than I already am if I told you that I have the answers to this and that there's one particular way that you need to practice AppSec.
2402440	2415920	Be like water. Adjust to your environment. Fill the container that you will be poured into and give the security that you really, really want to deliver to others.
2415920	2425560	Thank you so much. I really, really, really do appreciate having the opportunity to speak to you and for those of you that even made it to the end of this talk.