start	end	text
7740	9560	Good morning!
10540	14480	Yes, we are at AppSec Village and that's the kind of energy that we need.
15040	19500	I heard that there are so many registrations for this talk.
19500	22500	It makes us even more nervous. We are nervous.
22500	25160	We don't look nervous, but we are, a little bit.
25580	30600	We want to justify to all the people who have registered for the talk and have come.
30600	34620	So we'll share as much as information, to the best of our knowledge.
34620	39460	So today, we two are going to be sharing the stage.
39460	40920	My name is Vandana Verma.
40920	44040	I'm currently working with a software security company called Snyk.
44040	48660	And I'm also one of the Global Board of Directors for OWASP, which is open...
48660	50860	Who all know about OWASP?
52860	55100	Okay, what is OWASP?
58760	63100	No, it's really... I mean it. What is OWASP?
63100	65900	Ask for the full form.
65900	69700	Yeah, he said it right. Open Worldwide Application Security Project.
69700	71800	It used to be open web application.
71900	75680	So, applications are not just web applications.
75780	78800	It can be cloud, it can be microservices and what not.
78800	81680	So, I'm one of the Board of Directors for OWASP.
81680	85240	And I will let Viraj introduce herself.
85240	88760	Thank you, Vandana. Hello everyone, good morning.
88780	92680	I'm Viraj Gandhi. I'm Product Security Manager at the sales point.
93100	95780	And it's my pleasure to share a stage with Vandana.
96920	102900	Alright. So, today's topic is about running an AppSec program with a limited budget.
103100	107360	How many of you have started startups or want to start a startup?
109940	113260	We all want to. And some or the other way, we have it in mind.
113260	114860	Even I want to do it someday.
114940	119940	So, recently, or not so recent, but a year and a half back,
119940	126860	my friend said, I have a startup, but then I have no idea how to run an AppSec program.
126860	128620	That was a big challenge.
128620	130900	There were so many things that were going wrong.
130900	134340	There were so many vulnerabilities that were getting deducted.
134340	136720	But then, they didn't know what to do.
136780	141520	Can we all buy the tools that are there, which are costly?
141800	145700	Or, on top of it, if I talk about this need for program,
145700	150080	because we do want to make sure that we have customer trust.
150080	153740	We are compliant by all the compliances that are there.
153840	155700	ISO is just one of them.
155700	157200	What about GDPR?
157200	160920	What about so many... California CCPA, right?
161620	166900	CCPA. And then, in India also, there is a bill which has just been recently passed.
166900	170460	So, I'm from India, so I'm just going to patent India here and there.
170620	174500	Then, we want to make sure that we reduce the business risk.
174500	176480	These are just some of them.
176540	179020	But what about the attacks that are happening?
179440	184840	Can we say, if we have all the best tools in the world, we are 100% secure?
186400	188280	Yes? No? Maybe?
188280	189940	Let's keep it engaging.
190120	191680	We don't want to bore you.
192380	195720	See, the best of the companies have been hacked.
195720	201500	The best of the companies have been part of some breaches, some or the other way.
201500	206120	Like, if you go and look up your email on one of the websites called Have I Been Pawned?
206120	208760	You would know that somewhere you might be.
208760	210520	My email addresses have been there.
210520	213360	So, I had to do multi-factor authentication to what not.
213420	216420	Right? Have you seen Have I Been Pawned?
217140	219760	Yes? No? Yes?
220260	223840	Some of you, yes. Because then I can see the energy that we have not seen.
223840	225380	So, go and look up your email.
225620	227760	Don't dump in too much of information.
228640	237940	Now, all of us have been in a situation that we have tens and tons of things that we want to take care of.
237940	240180	And that's where AppSecProgram lands.
240180	242320	And then, we have DevSecOps.
242320	246900	We have specifically application security team.
246900	248800	And then we have DevOps team.
248800	250480	Then we have cloud security team.
250480	252420	Then we have network security team.
252420	255120	And there are so many things that we are doing right now.
255120	261320	Now, with application security program, we will share certain tools which will fit right into DevSecOps.
261320	264600	Which will rightly fit into all of these programs.
264600	268940	Now, we will start off with application security program.
268940	273860	You will see, like, these three things, people, process, tools, it's just the same.
274000	275880	Trust me, it's just the same.
276020	280480	But, the interesting bit comes is security education.
280540	283840	Now, that's what we are here for, to share our experience.
283840	286720	In the end, we will take up information from you as well.
286720	290840	Because we know that there are some things that we are sharing from our experience.
290840	293380	But we would love to know from your experience as well.
293380	297320	How you have been through the journey of security education.
297420	300240	And it all starts with open source.
300240	302620	How many of us use open source?
303900	305200	Most of us.
305220	311340	Do you know, when we talk about open source, on the internet, 80-90% of the applications use open source.
311520	313680	There are research studies which say that.
313840	318840	And when that much of code is open source, how much are we left with the code that we develop?
319060	320600	Only 10-20%.
320600	325620	And on top of it, we have containers, we have ISE, which is infrastructure as a code.
325620	329040	And then comes cloud, where we are pushing all our applications.
329280	334560	So, while we talk about it, there is a process that we need to follow, which we are following.
334560	338340	I am not going to question any organization that they are not following.
338480	339140	Correct?
339180	342020	But do we use open source tools in our companies?
342020	344840	Yes, we do. Right?
344840	348940	So, which is the best tool that you have used so far?
351400	352620	That works for you.
355560	356440	Okay.
362440	363940	Okay. And?
365240	368740	Okay. Perfect. Yes. I love it.
368940	370800	Zap. Zap. Zap.
370800	375060	That's right. Zap. If I will not say Zap, then everyone is going to catch hold of my neck.
375120	376200	Okay.
377280	379580	SAM for SBOM. Right?
380660	382080	SAM for SBOM?
383320	385900	SAM is a maturity model tool.
386020	388720	And Cyclone DX is for SBOM.
388720	393920	How many of us are taking care of application security and they need to deal with all the third-party dependencies?
394580	395620	We all.
395620	400600	So, trust me, go look for Cyclone DX. It's one of the amazing projects that I love.
400600	404480	Now, I am going to shut my mouth or she will say that I have taken over the stage from her.
405120	406640	I was about to say that.
407780	412840	So, before we start, I would like to know how many developers are there in this room?
412840	414480	Can you please raise your hand?
415080	416560	Wow. Wow.
416560	422640	So, before we talk about the importance of the AppSec program in your organization,
422640	426960	I would like to talk about the evolution of the modern software development.
427100	430380	The modern software development has lots of moving parts.
430380	437700	Agile methodology, the Kubernetes cloud deployment, adoption to the third-party components library.
437720	441400	All of that has accelerated the software delivery.
441400	445600	But at the same time, it has added the complexity and risk.
445600	453340	And for that reason, there has to be a security requirement placed in your development lifecycle.
453340	459580	The study shows that at least 86% of the breaches are happening at the application layer.
459580	465910	So, definitely the web application is a primary attack vector targeted by criminals.
466320	472000	And we have to make sure we have the AppSec program established in our organization,
472000	476880	regardless of the size and the budget the organization has.
477420	481160	So, what are the core pillars for the AppSec programs?
481160	484870	So, here you see on the slide, people, process, and the tools.
485100	488920	They are the three core pillars for any AppSec program.
489580	493280	When we start with the people, it's all about bringing the security awareness,
493280	496940	developing the mindset among the developers,
497580	501140	fostering the security-first development culture,
501140	505920	so that everyone is contributing to the security, not just the security engineer.
505920	509860	That you can leverage by establishing the champions programs
509860	515640	or coming up with a developer training for the developers of your organization.
515640	521600	When we go with the process, it's all about achieving the secure development life cycle
521600	528300	that you can achieve by establishing how to handle the incidents,
528300	531700	like the playbook for your incidents,
531700	535000	how to handle any vulnerability coming from the various sources,
535000	538260	like the tools or the external customers reporting,
538260	541500	or the internal engineering reporting those vulnerabilities,
541500	544320	how the vulnerability life cycle will be,
544320	549640	what are the remediation process that you need to put in place.
549640	556000	And when we talk about the tools, tools is helping for the automation,
556000	558340	for the detection of all the vulnerabilities.
558340	561680	There are the various tools that you can place in your pipeline.
561680	567220	And again, like one or two, like a SAS and SCA tool are not sufficient in your pipeline.
567220	570000	They're going to do more like static analyzer testing.
570000	573140	You still need like a runtime detection for that,
573140	575660	like you still need the IAST or DAST.
576180	580420	And also like, you know, before you start coming up,
580420	584680	like what are my application security needs for my organization,
584680	590180	what framework should I seamlessly integrate in my development life cycle,
590180	593080	you need to understand, have a deep understanding,
593080	596260	what is your organization business objective,
596260	598120	aligning to the business goal,
598120	604020	you need to establish a comprehensive application security plan,
604020	606040	by considering like, you know,
606040	608840	what is the product offering of your organization,
608840	611520	what are the languages used to build that products,
611520	613560	what is the tech stack looks like,
613560	616080	and how is the customer usage.
616240	618120	Considering all those aspects,
618120	620920	you need to come up with the abstract program framework
620920	623580	that is more aligned to your business objective,
623580	626840	and that can help in mitigating the risk,
626840	630020	and also achieving the cyber resiliency.
630100	631780	Next slide.
633060	637660	So, regardless of the size, the budget of your organization,
637660	639720	these are the three common goals
639720	643120	what every organization in the industry will have,
643120	647920	to like, trying to reduce, limit the risk in your deployed code,
647920	651700	like no company would like to release the vulnerable code,
651700	655240	and also achieving, building a secure software
655240	658320	by making sure that the security is infused
658320	662500	in every phase of your development life cycle.
663660	666620	Taking advantage of the developers,
666620	668760	developing the security mindset in that,
668760	670340	so that they can also contribute
670340	673400	for achieving this software security,
673400	675140	and at the end, we want to demonstrate
675140	678500	and showcase the software security maturity
678500	682420	for our organization through the metrics and the reporting.
684940	687660	Over to you, Vandana, for the AppSec framework.
688460	691200	So, I love animation.
691200	692680	We have not put animation here,
692680	694060	because we just wanted to make sure
694060	696460	that we walk you through the whole journey.
696640	699460	So, the first thing is, in application security program,
699460	702840	or even when we are thinking about developing a program,
702840	704600	is the requirement gathering.
704680	706280	Do we all agree or not?
707560	709380	Yes, no, maybe?
710320	711200	Yes.
711200	713660	So, when we gather the requirement,
713660	715260	the interesting bit comes is,
715260	717380	where should we track the requirements?
717780	720380	When I started working in application security,
720740	723580	the requirements were gathered in an Excel sheet.
723960	727100	Excel sheets were passing from one person to another.
727180	729220	Now, when that passed on,
729220	731720	trust me, I've been there, done that,
731720	734760	there were so many iterations that used to happen,
734760	738340	that it used to be a blunder in the end of the day.
738340	740660	Now, when at the end of the day, it's a blunder,
741200	743680	you don't know what's going to be next.
743680	745600	There are people who are making changes.
745600	747700	There were iterations, there were versions,
747700	750500	but still, it was a big chaotic thing.
751060	754500	What it needed is, it needed a refinement.
754540	756160	It needed some change.
756160	758540	So, I actually started working on a project,
758540	760340	where I was thinking like,
760340	763060	what to do for these requirements gathering.
763060	764980	So, there's a tool called OWASP,
764980	766860	Security Knowledge Framework.
766860	768080	Have you heard of it?
768820	770920	Yes, some people have heard of it.
771200	771940	I don't know about everyone,
771940	774220	but trust me, you should go back and check.
774220	775980	It has an amazing GUI.
775980	778200	It's an open source tool, free to use.
778200	780160	You can make your own enhancements,
780160	782080	and it's a complete package.
782120	784000	It's not just a requirement gathering tool,
784000	786720	but there are multiple things which I would be covering.
786720	788640	So, for OWASP, Security Knowledge Framework,
788640	791440	I realized I can actually have a big checklist
791440	793340	of the things that I can have,
793340	794760	as part of my tool.
794760	797200	Like, what language I would be using,
797720	799880	and at which phase I would be using.
799880	802340	So, you can actually divide it into sprints.
802660	805040	We all use sprints, maybe bi-weekly,
805040	808340	or for every application we use these sprints.
808340	810480	With using OWASP Security Knowledge Framework,
810480	811840	you can pick up the language,
811840	814120	you can pick up the test cases that are there,
814120	816480	because I don't remember all the test cases,
816480	818780	what should be there as part of my application.
818780	820060	I can pick and choose,
820060	821800	and I can actually send it to my developers
821800	823300	that this is what I want to do.
823300	824960	And with every modification,
824960	826880	there will be a new version that will be created,
826880	828480	so that you can track it,
829880	831300	and you can see it on the Excel sheet.
831420	833020	Now, I started using that.
833020	835980	But then, Threat Modeling became a big challenge.
836040	837900	Who all do Threat Modeling here?
839340	840680	Some of us use.
840680	843620	So, Threat Modeling, some people say it's a tedious task.
843620	846420	Some people say you can do it as fast as possible.
846420	849440	Some people say, oh, it should be done
849440	853180	only before the application development starts.
853180	854300	But let me tell you,
854300	857640	Threat Modeling is something which we should do at every phase.
857680	859020	We can do a Threat Modeling
859880	861240	when we are discussing about the requirements.
861240	862400	We can do Threat Modeling
862400	865200	when we are actually building the application.
865260	867100	We can do it via code as well.
867100	870060	There are tools which can do Threat Modeling as a code.
870180	873240	So, there is a tool called OWASP PyTM
873240	876920	that can actually navigate through all your code,
876920	877900	even in cloud,
878460	879840	and can tell you that, yes,
879840	881440	these are the things which are there.
881440	882860	And then, on top of it,
883400	886080	there's a Threat Dragon, which you should look at.
886620	888800	Have you heard of Threat Modeling Manifesto?
889880	892580	Yes. Some people have heard, but not...
892580	893880	But if you want to actually...
894680	896900	or if you are interested in Threat Modeling,
896900	900420	then you should definitely check out Threat Modeling Manifesto.
900560	905000	Now, organizations are moving towards Threat Modeling as a code as well,
905000	909200	where you want to know about your application code in the cloud.
909200	910240	How would you do it?
910240	912480	You want to know about your cloud environments.
912480	913920	How would you take care of it?
913920	916460	So, you can do the Threat Modeling as a code itself
916460	918180	for your cloud environments.
918180	921380	That's where you can take help from all these open source tools.
921640	924300	Now, I'm taking the name just to set the context,
924300	927660	but I have a slide where you can just take a picture of all those tools
928140	929800	and you would be able to use it.
929800	932160	And I'm going to use most of the open source tools' names
932160	935000	so that it's easy for you to go back and pick up.
935000	936860	And even if there are challenges,
936860	940280	I've created a video recording for each tool.
940940	942620	At least 30 tools have done it,
942620	946840	where you can just look at the 10 minutes video for each tool
946840	949720	and you can figure out what tool actually does.
949800	953960	Because, see, for me, if I start reading, I will sleep off.
953960	956880	Trust me. We all have that reading fatigue.
957020	960040	There are some people who are good, but then I am not.
960040	962020	So I accept that this is my flaw.
962020	964860	But when I talk to someone, someone tells me and shows me
964860	967960	this is how a tool works, a documentation project works,
967960	969140	it helps me.
969140	973060	And especially for the people who are starting their own AppSec program
973060	976080	for open source, for startups,
976080	977460	for mid-sized business,
977460	980180	you should definitely check Project Spotlight series.
980180	982580	Because it not only talks about
982580	984400	requirements gathering, threat modeling,
984400	987400	but it also talks about how you can do source code review.
987400	990460	So in October end,
990460	993140	we have a conference in DC, OWASP,
993140	996580	where we will be releasing source code review checklist.
996580	998420	So do keep a check on it.
998420	1002880	Source code review checklist was updated for all the developers.
1002880	1005540	It was updated way back in 2017.
1006080	1008520	It has not been updated since then.
1008540	1011200	But for all of us to get to know
1011200	1014840	what are the test cases that can be there for all the new languages,
1014840	1018040	we have Node, we have JavaScript,
1018040	1020840	then we have Go, we have so many other languages.
1020840	1022300	But what do we do?
1022300	1025680	So source code review checklist will help you out.
1025720	1029580	And after that, when I talk about vulnerability testing,
1029580	1033980	I want to get that embedded as part of my DevSecOps pipeline.
1033980	1037980	So ZAP, OWASP ZAP, which is Z-Attack proxy,
1037980	1041120	can actually help you out in integrating it
1041120	1044200	within your environment, within Selenium.
1044200	1047500	There are so many plugins, there are so many test cases which are there,
1047500	1049020	which can help you.
1049020	1053560	And for defect tracking, have you heard about a tool called Defect Dojo?
1054180	1055260	Defect Dojo.
1055260	1058220	So Defect Dojo is the tool which can help you in getting
1058220	1060880	all of those test cases, all of those vulnerabilities
1060880	1063500	in one ecosystem.
1063500	1066000	Like we have Remedy, we have Snow, we have many other tools
1066000	1067940	which are commercial.
1068140	1071440	So you should use commercial tools, but before that,
1071440	1074160	what I would say is try open source.
1074520	1075920	Know your appetite.
1076380	1078760	I have a few friends who are CSOs, what they've done is
1078760	1081800	they've bought some tools which look fancy.
1081800	1083300	Trust me, they're fancy tools.
1083300	1084820	Everyone talks about it.
1084820	1087000	But do we have the budget for it?
1087140	1088920	No, we don't have budget.
1088920	1091560	But with open source, you can start the budget as
1091560	1096080	maybe $0 or maybe $10 based on the cloud fees,
1096080	1097980	if you want to set it up in the cloud.
1097980	1100320	So you should actually check out Defect Dojo.
1100320	1103420	It's easy to implement, easy to integrate from callers
1103420	1105840	to all of these tools which are commercial tools.
1105840	1109020	It can actually take out the data and show you
1109240	1110400	a nice dashboard.
1110500	1112180	How many of us are executives here?
1112180	1114720	We have talked about the developers.
1114720	1117260	How many of us are CSOs or executives here?
1117260	1118820	You are.
1118860	1121440	So for them, the big challenge is,
1121440	1123440	we don't understand, but the biggest challenge is
1123440	1126000	how to actually get the budget from the board
1126000	1129180	and how to make sure that we are aligned
1129180	1131400	with our budget and get the right tools.
1131580	1134080	So while we were working on setting up
1134080	1135840	the program for this startup,
1135840	1138440	we realized that these tools are there,
1138440	1139840	but how do we integrate?
1139880	1141820	Is there any integration available?
1141820	1145400	So for integration also, we have created a small video.
1145400	1146880	We will be sharing all the content
1147260	1149860	at the end because in this presentation,
1149860	1151840	we want to share that, okay, these are the resources
1151840	1153160	which you can take a look at it
1153160	1154800	and pick up what you need.
1154800	1156940	It's like a buffet we have created for you.
1156940	1158460	You pick and choose from that buffet
1158460	1161400	because there's so many things that are happening around
1161400	1163460	and everyone has their own terminology
1163820	1165280	for these things.
1165520	1169300	Now, the interesting bit comes is,
1169300	1170880	we do secure code review,
1170880	1172720	we do vulnerability testing,
1172720	1175500	but now open source has become a challenge.
1175500	1176760	Why do I say that?
1177260	1179240	Because we are using it so heavily,
1179240	1181400	but then, with great power,
1181400	1182960	comes great responsibility.
1183060	1184680	I think Spiderman says that,
1184680	1186040	but I love this quote.
1186040	1187360	Why do I say that?
1187840	1190240	Have you heard about a breach which happened around,
1190240	1191140	actually not a breach,
1191140	1193740	but a big vulnerability around Lock4J?
1194080	1194960	Yeah?
1194980	1197940	Trust me, we had sleepless nights when this happened.
1197940	1199220	I was on a vacation.
1199480	1201120	I was like, oh, December,
1201120	1202480	I'm not going to do anything.
1202480	1204060	I'm going out for vacation.
1207260	1208820	Because we were just going on and on
1208820	1210420	that we are working from home.
1210420	1212320	But I took a good vacation of three weeks
1212320	1215800	and then I saw everyone is talking on Twitter,
1215800	1218640	LinkedIn, Slack, everywhere.
1219100	1219980	Why?
1219980	1221040	Is it new?
1221040	1222480	No, it is not new.
1222480	1225820	These vulnerabilities have been there since ages.
1225820	1228240	Since we have started talking about open source.
1228240	1228740	Why?
1228740	1230200	Because we forget to update
1230200	1233200	or we forget to maintain the list of things
1233200	1234780	that we have in our house.
1234780	1236760	So, I'll tell you a funny thing.
1236840	1237940	We have four doors
1237940	1240400	and four windows in our house.
1240560	1242520	So, oh, my God.
1242520	1243660	Okay, I'll give you.
1244040	1246900	So, yeah, that's what I do.
1247100	1249300	Because I move my hands a lot.
1249300	1251140	So, in our house,
1251140	1253140	we have four windows and four doors.
1253160	1254480	When we went on vacation,
1254480	1255900	we closed everything.
1255960	1258140	But there is one thing we missed to close
1258140	1259400	was the attic.
1259560	1261560	Now, that's called open source.
1261560	1262940	We thought it's on attic.
1262940	1265420	Who will get it on attic and do something?
1265460	1267280	Somebody comes from attic,
1267280	1269720	takes whatever information they want,
1269720	1270920	whatever things they want,
1270920	1272040	and goes away.
1272220	1274300	Do we want that? No.
1274340	1277060	So, that's where open source comes into picture.
1277060	1279420	Now, if I say Log4j gave us sleepless nights,
1279420	1281160	but in 2017, there was a breach
1281160	1283420	which happened, big breach.
1283420	1284280	Actually, I'm talking about,
1284280	1285480	it's not just a vulnerability,
1285480	1287500	but breach happened because of Apache,
1287500	1289200	older version,
1300920	1302980	not to blame Apache.
1302980	1304120	Why do I say that?
1304120	1305720	Because they told everyone
1305720	1307560	that there is a vulnerability.
1307640	1309020	They released a patch.
1309020	1310540	After releasing the patch,
1310540	1312800	companies started updating,
1312800	1315880	but then the exploit was being used everywhere.
1316080	1317460	And this company got breached.
1317460	1318580	And until now,
1318580	1320680	the fines are being happening.
1320680	1321200	They didn't know
1321200	1321540	what's going on.
1321540	1324780	How much data actually got hacked?
1324780	1326740	Who all companies got hacked?
1326740	1329020	So, it was very, very crazy.
1329380	1330300	But then,
1330300	1331780	after five years, six years,
1331780	1333300	we're still sailing in the same boat
1333300	1334480	talking about it.
1334480	1336780	And that's when OWASP dependency check
1336780	1337920	can help you out.
1337920	1340180	If you talk about supply chain attacks,
1340180	1341900	are they new? No.
1341900	1343100	They're not new.
1343100	1344920	But then when supply chain attack,
1345560	1348700	it happened on Orion server,
1349280	1349580	SolarWinds,
1351540	1352460	everybody was like,
1352460	1354200	oh, supply chain attack is happening.
1354200	1355680	We need to take a look at it.
1355680	1358160	But remember that we are using
1358160	1359860	all of these dependencies.
1359860	1362200	Are we maintaining a list of it? No.
1362200	1363480	And that's where,
1363480	1365180	especially if I'm talking about
1365180	1366820	for open source organizations
1366820	1369780	or the organizations who want to use open source,
1369780	1371520	let's start scanning it
1371520	1372800	from dependency check,
1372800	1375760	which actually pulls the data from NPD database.
1375760	1377040	And from there,
1377040	1379020	you can actually send all the details
1381540	1383080	and you can have a list of things.
1383080	1385480	Like I forgot to close my attic, right?
1385480	1386220	Window.
1386220	1387780	And I didn't know what I have.
1387780	1389520	So you need to know what you have
1389520	1391060	and then only you can secure it.
1391060	1392540	Not from external threats.
1392540	1395180	Trust me, first, if we secure our home,
1395180	1396880	80% of the things are done.
1397540	1398520	Most of the times,
1398520	1399880	what I have seen attacks is that
1399880	1401660	we don't secure our home itself.
1401720	1404540	And for that, we need to train our people.
1404580	1407180	We need to educate that these things exist.
1407180	1409780	Actually, these things actually make a difference.
1411540	1411840	Thank you.
1412440	1413920	Thank you, Vandana.
1413920	1415460	So this is the ideal
1417300	1419120	secure software development life cycle,
1419120	1420880	how it should look like.
1420880	1422660	So anyone is interested in
1423560	1425760	establishing the AppSec program,
1426300	1428140	these are the few things
1428140	1429520	what you need to do,
1429520	1431240	must do in every phase
1431240	1433480	of your development life cycle.
1433860	1435980	With the recent economic downturn
1435980	1437600	and the team sizing,
1437600	1439980	still there is a challenge for all the businesses
1439980	1441900	that how they can protect
1441900	1444440	their company from the risk,
1444440	1445540	how they can come back
1445540	1448700	with the tech-savvy cyber criminals,
1448700	1450240	like how they can achieve
1450240	1452040	more from the less.
1452740	1453840	This morning,
1453840	1455040	the speaker mentioned that
1455680	1457920	every company has a desire
1457920	1460680	of how can we get most from the less,
1460680	1462760	like how can we still establish,
1462760	1464100	have a feasible,
1464100	1467120	cost-effective application security program,
1467120	1468580	while also reducing the cost
1468580	1470960	of the operational and the development
1470960	1473040	and the licensing cost.
1473040	1474140	So a few things
1474140	1477500	to be considered.
1477500	1478720	I'll talk about
1479580	1481080	starting with the people
1481080	1482840	and the process prospective,
1482840	1484380	what you can be doing
1484380	1485500	in order to achieve
1485740	1488780	a cost-effective application security program.
1489140	1490100	To start with,
1490100	1491900	like Vandana mentioned,
1491900	1494580	establish a design architectural review
1494580	1496580	using the open source,
1496580	1497560	like Red Dragon,
1497560	1499420	so that you are identifying the threats
1499420	1502080	and potentially it will be cost-saving
1502080	1503700	if you are detecting those threats
1503700	1504880	as early as possible
1504880	1507420	in your development life cycle,
1507420	1508940	rather waiting for the threats
1508940	1510040	to become the vulnerability
1510040	1512380	and then getting reported by the customer
1512380	1514920	or by hackers.
1515720	1517420	Other few things what you can do
1517420	1518860	is like,
1518860	1522640	if you are QA engineers,
1522640	1523840	mainly your measurement
1523840	1525040	would be around the performance
1526580	1528020	but also start considering
1528020	1529800	the security while you are doing
1529800	1532840	those testing of your software,
1532840	1534600	that way also you can easily detect
1534600	1535340	those vulnerabilities
1535340	1537340	and get remediated more early
1537340	1539760	in your development life cycle.
1540260	1541860	If the company is doing
1542680	1544480	the regular pen testing,
1544480	1545760	sometimes you have to do
1545760	1548580	because of the compliance certification purpose.
1548580	1550320	You can think of reducing
1550320	1553700	the cadence of those testing cycles.
1553780	1556120	It can be cost-draining.
1556120	1557140	You can always complement
1557140	1560660	by establishing internal pen testing program.
1560660	1563300	All you need is to hire a pen tester
1563300	1566700	that can continuously do the pen testing.
1566860	1567660	And also,
1567660	1569120	things to consider like
1569120	1571120	if your feature or a software
1571120	1573400	is about to get depreciated,
1573400	1575880	don't spend the effort, time
1575880	1577700	in running, scanning the tools.
1577700	1579480	You can easily free up the license
1580120	1581760	if you know that only
1581760	1584220	minor cosmetic UI changes
1584220	1585360	you will be supporting
1586120	1587840	that the software
1587840	1589340	that is getting depreciated
1589340	1590820	and just make sure that
1590820	1592000	the annual pen testing
1592000	1593700	is being performed.
1593840	1595680	Many smaller organizations,
1595680	1598160	they take advantage of the VDP
1598160	1600780	and the private bug bounty program.
1600780	1602400	You get the perspective
1602400	1603800	from external researchers
1603800	1606400	who can help you in identifying
1606400	1608580	those vulnerabilities in your software.
1608580	1611160	And again, it's very cost-effective.
1611160	1612600	So these are the few measures
1612600	1614320	that you can do
1616120	1617020	to establish a feasible,
1617020	1618060	cost-effective
1618060	1620520	application security program.
1622200	1622960	So,
1622960	1624180	next one is
1625200	1628020	I talk about the people prospect aspect,
1628020	1629020	now the tools,
1629020	1630300	like what are the tools
1630300	1632580	that you can leverage,
1632580	1633580	the open source tool
1633580	1636200	and especially the tools
1636200	1638700	available from the OOPS universe.
1638700	1640420	But now, already gone over
1640420	1642560	many of the tools from the OOPS.
1642560	1643660	But there are still
1646120	1647260	many tools that you can leverage
1647260	1649440	and integrate in your pipeline
1649440	1650680	and still have a feasible
1650680	1653480	application security program.
1653740	1656160	If you guys were around yesterday,
1656160	1658180	there was a workshop from the SAMGRAP.
1658180	1660800	It's a lightweight static analyzer tool.
1660800	1662040	They gave an amazing workshop
1662040	1664760	of how to customize the rule set.
1664760	1666560	So open source do have the capability
1666560	1668280	to write a customization code
1669020	1670600	and help you to detect
1670600	1673120	the business flow from your software.
1673960	1675800	If the source code
1676120	1676720	is in a GitHub,
1676720	1679200	you can easily enable the depender bot
1679200	1681460	just with a 2-3 button click
1681460	1684400	and with a minor configuration changes.
1684400	1686320	It will start detecting any vulnerabilities
1686320	1688700	there in the third party libraries.
1689020	1690160	And trust me,
1690160	1691760	integrating the open source
1691760	1693080	is very easier.
1693080	1694760	You don't need to spend months
1694760	1696520	or number of the weeks.
1696520	1698380	In a few days, you can easily integrate
1698380	1700920	and start detecting those vulnerabilities
1700920	1702500	from your pipeline.
1703940	1705920	And like I said earlier,
1706120	1707340	SAST and SCA scan
1707340	1708240	are not sufficient
1709340	1711480	in your pipeline.
1711920	1713980	Lately, like many code is getting
1713980	1715720	deployed into the containers
1715720	1717180	and containers are being...
1717820	1719940	they are being built
1719940	1721620	from the baseline images
1721620	1724080	and if the baseline image is vulnerable,
1724080	1725640	the application also indirectly
1725640	1727420	gonna inherit those vulnerability.
1727740	1728940	So for that, the infrastructure
1728940	1730300	as a code scanning
1730300	1732840	is also very necessary.
1732840	1734340	And there are the open source tools
1736120	1737000	like TensorFlow and TFSEG
1737000	1738040	that you can leverage
1738040	1740540	that gonna scan your Terraform files
1740540	1742280	and it's gonna detect
1742280	1743760	the misconfiguration
1744720	1746140	in your code.
1746160	1748660	So these are like, you know,
1748660	1750740	again, like this list is comprehensive
1750740	1752600	but again, there can be more list
1752600	1753480	of the open source
1753480	1754980	which still like, you know,
1754980	1756420	we are still trying to figure out
1756420	1758120	and we are keep on adding that, you know,
1758120	1761000	where it fits in our development phase
1761000	1762140	of the cycle.
1770660	1772280	Over to you, Anna.
1772460	1773680	Great, thank you.
1773680	1775900	Now, sometimes pictures can be deceiving
1775900	1777160	so we thought, okay,
1777160	1780180	let's go ahead and mention each of those tools.
1780180	1781000	That what they do
1781000	1782520	for training and awareness,
1782520	1783920	what documentation can be there
1783920	1786060	for security, what documentation
1786060	1788200	for requirements gathering, what can be there
1788200	1790380	for SCA, what all tools are there
1790380	1792020	and for knowledge management
1792020	1794480	like application security, verification standard.
1794480	1795880	Have you heard of application security
1795880	1797340	verification standard?
1800460	1801320	When I started,
1801320	1804060	so I started my career in network security.
1804060	1806740	I was configuring firewalls, routers, switches,
1806740	1808120	with those hardwares,
1808120	1810060	like way back in 2005, 2006,
1810060	1811320	that were the things, right?
1811320	1812600	Because we didn't have softwares
1812600	1814200	which we have now.
1814200	1816600	But then, I joined my second company
1816600	1819000	as a SIM admin.
1819420	1821520	Now, mind it, I'm supposed to join
1821520	1823100	as a SIM admin after five years,
1823100	1824000	six years of my career
1824000	1826300	and when I go on the first day,
1826300	1828200	my boss said that the role
1830460	1830500	that I'm supposed to play
1830500	1832340	in the application security team,
1832340	1835180	trust me, I didn't know A of application security.
1835180	1837680	I did know a bit of coding,
1837680	1840220	but that too at a very, very novice level.
1840220	1841020	I would say,
1841020	1842740	now the kids knows better than
1842740	1844700	what we used to know at that time.
1844700	1846960	So, I didn't know anything.
1847120	1849860	So, what I started learning was about OWASP.
1849860	1851580	When I started learning about OWASP,
1851580	1853260	I only knew OWASP top 10
1853260	1855280	and testing guide, that's it.
1855280	1856460	Trust me, I was so happy
1856460	1858700	that at least I got to know something.
1860460	1861820	So, over the next few months,
1861820	1863920	I created a checklist from testing guide
1863920	1866660	and top 10, an Excel sheet,
1866660	1868160	beautiful Excel sheet,
1868160	1869780	so that my team can be,
1869780	1871600	can use it and can stay happy.
1871600	1873640	Oh, there's something which is there for them.
1873640	1874800	Now, I went to my boss
1874800	1875920	and shared that Excel sheet
1875920	1877860	and he started laughing.
1878260	1880080	Now, I'll tell you why,
1880080	1880640	because he said,
1880640	1883580	have you ever looked at ASVS?
1883640	1885280	I said, what is ASVS?
1885280	1886520	So, the person told me
1890460	1892800	which actually has different levels,
1892800	1893980	zero to three.
1894400	1895940	Like, if we are starting off,
1895940	1896840	we are at zero level
1897360	1899700	and then there are level increases.
1899700	1900880	If you are a fintech company,
1900880	1902900	you should definitely look at level three,
1902900	1903820	which is like,
1903820	1905920	which has the most number of test cases
1905920	1907520	which we should look at,
1907520	1908980	which we all, for pen testers,
1908980	1910900	for developers, for everyone.
1911120	1912520	And trust me, that day I realized
1912520	1914380	that OWASP is much more than testing guide
1914380	1915460	and top 10.
1920460	1921740	And then I had a fascination
1921740	1923620	that I need to get my name
1923620	1925200	on OWASP top 10.
1925420	1926960	Like, my name is there on the website,
1926960	1928400	which is a different story now,
1928400	1930180	but then on the top 10 list,
1930180	1933100	because they mention every volunteer,
1933100	1935180	every contributor on the GitHub.
1935280	1937440	How many of you know
1937440	1939460	that there is a GitHub for OWASP?
1940420	1941340	Some of you.
1941340	1943520	And especially for developers,
1943520	1944260	let me tell you,
1944260	1946260	there is a GitHub because you use it
1946260	1947700	day in and day out.
1950460	1951600	Where you can suggest
1951600	1953120	the changes in the code.
1953120	1955020	Because all the security people
1955020	1956680	are not so good in security.
1956720	1958620	Developers can be the best security people.
1958620	1960700	So you should definitely take a look at it.
1960700	1962940	You should suggest changes.
1962940	1964240	You should fork the repos
1964240	1966400	and then suggest the pull request.
1966440	1967720	And at the same time,
1967720	1969760	you can help in language as well.
1970080	1971000	There are many languages
1971000	1972580	that project can be converted
1972580	1974220	and then you would be marked
1974220	1976040	as the big contributor there.
1980460	1983180	Now, while we talk about budget,
1983180	1984480	I would let you speak first
1984480	1985420	and then I'll come in.
1985420	1987660	I just wanted to add that
1987660	1989100	for the OWASP community,
1989100	1990320	there are the Slack channels
1990320	1992120	for each of the OWASP projects.
1992120	1993800	So you can join those channels
1993800	1996420	and you can get the latest update
1996420	1997340	on what's going on
1997340	1998940	on each of the projects.
1999120	2001040	So this is just a guideline
2001040	2004400	of how you can allocate your budget
2004400	2005840	on what all category
2005840	2007920	to again establish
2010460	2010620	your budget.
2010620	2012280	It's not a setting stone.
2012360	2013800	Like the bigger company
2013800	2015200	that has unlimited budget
2015200	2017520	or like the budget with many zero,
2017520	2018580	they can easily go
2018580	2020500	with the commercial licensing tools
2020500	2022020	and help the developers
2022020	2024040	to identify, detect those vulnerabilities
2024040	2025820	and do the remediation
2025820	2027020	and also come up with
2028100	2030580	a customized reporting chart.
2030580	2032080	But for an organization
2032080	2035400	that has a limited or zero budget,
2035400	2036520	you can leverage
2040460	2041800	that secure software
2042350	2043180	development life cycle
2043180	2044460	for your software.
2050420	2051420	Okay.
2051980	2054460	Now, when we talk about measurement,
2054460	2055940	the first thing that you all
2055940	2058060	should look at, where do we stand?
2058060	2059260	Because we all don't know
2059260	2060320	where do we stand.
2060320	2061880	So first things first is that
2061880	2063160	wherever we stand,
2063160	2064640	we should start from there.
2064640	2067160	And understand from the
2067160	2068100	governance perspective
2068100	2069880	that what are the strategies
2075280	2076180	and how do you know that?
2076180	2077700	So OWASP SAM,
2077700	2079660	Security Assessment Maturity Model
2079660	2081880	has all the test cases.
2081880	2082820	Now you'd be thinking,
2082820	2084660	do I need to read the documentation?
2084700	2087140	No. We have done the work for you.
2087140	2089500	You just go to OWASP Project Spotlight Series
2089500	2091420	on YouTube and you would be able
2091420	2093320	to figure out everything.
2093420	2095000	So project leaders have explained
2095000	2098000	each project and it will help you
2098000	2100020	and analyze that, okay,
2100020	2101660	you have SCA,
2101660	2102740	you have SAST,
2105280	2106540	you have everything which is missing.
2106580	2108080	Okay, maybe something around
2108080	2109800	training around compliance.
2109800	2111840	Maybe there are certain checklists
2111840	2113160	that you need to assess
2113160	2115760	threats which are there
2115760	2118200	or sometimes the security
2118200	2120520	requirements itself are not very clear
2120520	2122360	or they're changing.
2122360	2123960	Very, very important to have that
2123960	2125700	because how do you track
2125700	2127300	all those changing requirements?
2127300	2128660	We are living in an agile world
2128660	2130440	so very important to have that
2130440	2132040	and automation.
2135280	2137860	Remember automate, automate, automate.
2137860	2138540	Automate anything
2138820	2140620	which is humanly possible.
2140620	2141980	Now for open source,
2141980	2143160	the automations are available
2143160	2144440	from each tool.
2144440	2145660	When I say I have done
2145660	2146940	that requirement gathering
2146940	2149460	to the actual production,
2149460	2151980	there are automation pieces available.
2151980	2154700	The talk that we are giving here,
2154700	2155520	there's a next talk
2155520	2156820	which we should be giving
2156820	2158740	but we gave that talk early on
2158740	2161460	how exactly you can integrate
2165280	2165380	into your own environment.
2165380	2166500	The talk is already there.
2166560	2167800	You just need to look at that talk
2167800	2169820	that okay, these are the pieces that I need.
2169820	2170980	I need SCA.
2171180	2172500	How I can do that?
2172600	2174360	So you can just pick it up,
2174360	2176880	download and you're good to go from there.
2176880	2178040	The developers don't need to read
2178040	2179460	the documentation also.
2179460	2180200	The video is there,
2180200	2181880	10-minute video which actually
2181880	2183260	explain everything.
2183340	2185020	And then when I talk about
2185020	2186580	security testing,
2195280	2197160	where they have actually
2197160	2199740	modified the scripts for themselves.
2199740	2200980	They have automated so that
2200980	2203140	they don't need a commercial tool.
2203140	2205220	But they bought it afterwards
2205220	2206560	because they wanted to
2206560	2208540	analyze their own appetite.
2208540	2209660	So always, always,
2209660	2211560	even for enterprise I'm talking about,
2211560	2213660	first analyze what you need.
2213660	2215480	Even though it looks fancy,
2215480	2216760	but it can be very deceiving
2216760	2219040	if you do not know
2219040	2220640	that what exactly
2220640	2221740	or what are the requirements
2221740	2223360	that your developers have.
2223360	2224400	Another thing is that
2224400	2226840	when we talk about maturity measurements,
2226840	2229400	it also needs a bottom-up approach,
2229540	2230660	a top-down approach.
2230660	2232880	Now what is top-down approaches?
2232880	2234200	Whether the leadership is asking
2234200	2235600	what do you need?
2236280	2237640	And at the same time,
2237640	2239200	there's another thing is ROI,
2239200	2241000	which is return on investment.
2241000	2242600	If we are investing in a tool,
2242600	2244000	what are we getting?
2244000	2245660	Now it becomes developers
2245660	2246820	and security persons
2251740	2253260	using these many bugs
2253260	2254980	we have secured or fixed
2255940	2257380	or this is the backlog
2257380	2259040	that we have for which
2259040	2260720	we need to have commercial tools
2260720	2261620	so we can just raise
2261620	2262880	automated pull requests
2262880	2265280	or especially for SCN code review
2265280	2266120	I'm talking about,
2266120	2268580	but for vulnerability testing also,
2268580	2269740	these are the highlights
2269740	2270960	that can be there.
2271180	2272980	Now another important thing
2272980	2274760	comes is that there is
2275040	2276520	a limited budget,
2276520	2277300	but we need to look
2277300	2278560	at the whole roadmap.
2278560	2279780	What do we have?
2279780	2281780	How soon we want to have it?
2281820	2282980	This AppSec program
2282980	2284220	with open source tool,
2284220	2286800	I set it up in exactly 15 days.
2286860	2288200	It took me 15 days.
2288200	2289380	It can take a month for you
2289380	2290800	based on the environment.
2290800	2292260	For me, I wanted to set it up
2292260	2294000	on my local system, a VM,
2294000	2295880	so it took me 15 days
2295880	2296860	and I was like,
2296860	2298340	I have to do it,
2298340	2299740	but then for your team
2299740	2301840	it could take a month as well,
2301840	2303760	but then it will show the ROI.
2303800	2305080	And especially for my friend
2305080	2306480	who started a startup,
2306480	2308360	it was a hit
2308360	2310780	because he has to show the customer
2310780	2314140	that okay, we have an application security program.
2314140	2315760	This is how we are doing it.
2315760	2317980	This is how the vulnerabilities are coming
2317980	2319560	because if he says,
2319560	2321180	oh, we have everything the best,
2321180	2322360	trust me, things don't work out
2322360	2325460	and that's where the trust clashes comes
2325460	2327760	and big trust issues comes.
2327760	2329260	So we need to break down
2329740	2331920	what we must need,
2331920	2333220	what we should have
2333600	2334900	and what we can think of,
2334900	2335960	okay, we can do it,
2335960	2338360	but then there has to be a timeline defined for it
2338360	2340920	because if you don't know when you want it,
2340920	2343340	it will go on for months and months and months.
2343340	2345040	Now, what we are going to do is
2345040	2346400	we are going to keep our mouth shut here
2346400	2349440	and we will open up for any questions you might have.
2350500	2352100	I just wanted to add that
2352700	2354080	the open source are there
2354080	2356000	to establish your AppSec program,
2356000	2357180	but they are free,
2357180	2358620	but keep in mind that
2358620	2360040	you still need few resources
2360040	2362640	to execute, implement, establish
2362640	2364280	that AppSec programs.
2388210	2389790	I totally understand.
2389790	2392250	So when you go to the API section,
2392250	2393490	they have opened up APIs
2393490	2395090	which you can just pick up
2395090	2396810	and start using.
2396990	2399090	And the documentation is really good
2399090	2401230	where you can just go to the zap.com
2401770	2403050	and then you would be able to pick up
2403050	2404210	all of those requirements
2404210	2406890	and if they are not there,
2408230	2408790	you can do it yourself as well
2408790	2410130	because it's open.
2410170	2411290	Now, why do I say that?
2411430	2413930	Because this is being done by all the volunteers
2413930	2415630	on their free time.
2415810	2417110	So they are giving their best.
2417110	2420030	There are few things which might be missing for sure.
2420030	2421210	Let me put it this way.
2421210	2422050	We all accept it.
2422050	2423630	I run open source projects.
2423750	2426390	I just started something around AI,
2426390	2428970	but I would not be able to do it full time, right?
2428970	2430310	So there are few things which are there,
2430310	2431750	but yes, I can actually show you
2431750	2433390	every detail of it.
2438230	2438830	So if there is anything missing,
2438830	2440050	please do let me know as well
2440050	2441870	because I'm open for feedback.
2442450	2443770	Yeah. Yes, please.
2453040	2454820	Just last question.
2456260	2457860	So the question comes is,
2457860	2459300	how do you maintain the inventory
2459300	2461980	and you get to know about the assets, right?
2462380	2465880	So the interesting bit comes is the tagging.
2465880	2468640	So I use OWASP AMAS,
2468640	2470540	which actually helps in network discovery,
2470540	2472220	figuring out what all we have,
2472220	2474340	and then we put it in a database
2474340	2477120	and then start the tagging classification.
2477480	2478660	So we classify.
2478660	2480700	There are certain open source databases as well
2480700	2483080	that we are using where we are actually classifying
2483080	2485020	because classifying is very, very important
2485020	2485920	and that's a good question
2485920	2487500	because if you don't classify,
2487500	2489760	you would never be able to fix the vulnerabilities.
2489900	2491400	So that's where we do that.
2491400	2492840	Like we pick up and understand
2492840	2494100	even what we have,
2494100	2496520	even what we have not tracked in our database
2496520	2498180	using AMAS.
2498180	2499600	AMAS, yes.
2499860	2501740	AMAS is a really good tool.
2502220	2503460	Again, it's free.
2503460	2504420	Please use it.
2504420	2505700	Please share your feedback.
2505700	2506840	Please share inputs.
2506840	2509200	If you think that something can be done in that,
2509200	2510520	please make pull requests for that
2510520	2512420	or please suggest feedback on GitHub.
2512420	2513580	Very important.
2513580	2516020	These tools are supported by all the open source people
2516020	2517500	or the volunteers.
2517500	2519980	Even if you think there's something which is missing,
2519980	2522220	you can start your own project as well.
2522220	2524460	And we would love to promote that as well
2528180	2528880	Yes, please.
2531990	2532790	Commercial?
2533990	2536730	I work for a vendor, so I wouldn't name any tool.
2537230	2537990	Sorry.
2538310	2540490	That's why I'm wearing this T-shirt today.
2540490	2542390	Before this, I was wearing another T-shirt,
2542390	2544210	so I had to change.
2544210	2544870	I would be open.
2544870	2546590	Because here I'm speaking at AppSec Village.
2546590	2548430	If I say any name,
2548430	2549790	Erez is going to kill me.
2553050	2553710	Great.
2553710	2555030	So thank you so much.
2555030	2556070	We're going to be around.
2556070	2558270	If you have any feedback,
2558650	2559950	please do let us know.
2560010	2561030	We're open for feedback.
2561030	2562650	What changes can we do in the talk?