How to create a business case for expanding your AppSec program
- 1. © 2019 VERACODE INC. How to Create a Business Case for Expanding Your AppSec Program C o l i n D o m o n e y
- 2. © 2019 VERACODE INC. Introduction Why are we here?
- 3. © 2019 VERACODE INC. About the Presenter : Colin Domoney @colindomoney • Have run enterprise AppSec programmes • Former Solutions Architect at Veracode enabling customers and evangelising AppSec • DevSecOps consultant advising on how to build secure, safe software in a reliable and repeatable manner • Technologist at heart – interested in all new technology, particularly automation, containers, cloud.
- 4. © 2019 VERACODE INC. Agenda • Expanding the AppSec Programme at Deutsche Bank • Fighting for Budget • Strategies for Obtaining Budget • Programme Metrics That Matter • Findings from Our Customers • The Journey to a Mature Programme • Future Proofing Your Business
- 5. © 2019 VERACODE INC. Expanding the AppSec Programme at Deutsche Bank My own story
- 6. © 2019 VERACODE INC. AppSec Programme at Deutsche Bank • Established as a greenfield initiative in 2012 • Scaled from 150 apps to 1,900 in 3 years • Remediated 500,000 high severity flaws in a single year • Heavy use of automation to reduce manual effort • Staffed by only one AppSec expert • Supported by a small team of analysts
- 7. © 2019 VERACODE INC. Year One: Inception Year 1 • Scan and triage 150 most critical applications in estate • Reduce critical flaws in applications • Create awareness for AppSec PROGRAMME GOALS • Augmented the value of the manual pen-test programmes by removing ‘low hanging fruit’ • SaaS provided cost benefits due to low setup overheads BUDGET JUSTIFICATION
- 8. © 2019 VERACODE INC. Year Two: Expansion Year 2 • Expand programme to 750 applications • Used remediation calls to drive flaw closure PROGRAMME GOALS • Drive wholesale cost reduction of manual pen-test programmes while expanding coverage scope • Reduced developer effort by using AppSec experts as coaches BUDGET JUSTIFICATION
- 9. © 2019 VERACODE INC. Year Three: Remediation Year 3 • Closed over 500,000 high severity flaws • Deployed AppSec experts to achieve aggressive remediation • Created ‘security champions’ to promote security capability PROGRAMME GOALS • Small team provided massive net risk reduction reducing likelihood of costly breaches • Creating internal capability led to long term savings BUDGET JUSTIFICATION
- 10. © 2019 VERACODE INC. Year Four: Automation Year 4 • Expanded coverage to 2,500 applications • Injected automated scanning into all central CI/CD systems and artefact repositories PROGRAMME GOALS • Leveraged automation at all points to reduce manual labour costs of programme execution • Negotiated beneficial terms with Veracode based on our ability to execute and deliver value BUDGET JUSTIFICATION
- 11. © 2019 VERACODE INC. Fighting for Budget Getting more of the pie
- 12. © 2019 VERACODE INC. Getting More of the Pie All other security programmes and projects AppSec programme
- 13. © 2019 VERACODE INC. Steal Other People’s Pie • Show better business outcomes • Demonstrate higher efficiencies • Demonstrate ROI via consumption • Be more visible than others • Demonstrate cost savings
- 14. © 2019 VERACODE INC. Get a Bigger Pie • Demonstrate a vision for the future • Attach to a ‘pet project’ • Attach to a burning problem
- 15. © 2019 VERACODE INC. Strategies for Obtaining Budget It’s not just ROI
- 16. © 2019 VERACODE INC. “CISO’s Guide to Obtaining Budget” https://securityintelligence.com/series/a-cisos- guide-to-obtaining-budget/ Know Your Audience Know Yourself Cultivate Your Credibility Never Waste a Crisis Exploit Pet Projects
- 17. © 2019 VERACODE INC. Must Do, Should Do, Could Do https://www.risklens.com/blog/win-the-infosec-budget- cycle-a-short-guide-for-cisos/ • Regulatory and compliance Must Do • Prevent negative impact on your company Should Do • R&D and innovation Could Do
- 18. © 2019 VERACODE INC. Benchmarking Against Competitors https://www.veracode.com/state-of-software- security-report • Benchmark your company against competitors in your segment • If you’re lagging use this as a driver to invest and close the gap • If you’re leading use this as an opportunity to embark on more ambitious projects
- 19. © 2019 VERACODE INC. Heard via the Grapevine … “significant costs savings using a centralised solution over ad-hoc on demand siloed testing” “the cost of the programme is insignificant compared to the cost of losing customers” “we were losing customers because we couldn’t demonstrate we were developing secure software”
- 20. © 2019 VERACODE INC. Programme Metrics That Matter Numbers that count
- 21. © 2019 VERACODE INC. How To Measure Your Programme https://www.csoonline.com/article/3200270/cybers ecurity-spend-roi-is-the-wrong-metric.html https://www.fairinstitute.org/fair-book https://www.howtomeasureanyth ing.com/cybersecurity/
- 22. © 2019 VERACODE INC. Use Metrics to Manage Your AppSec Programme https://www.veracode.com/sites/default/files/Resources/Whitepapers/using- metrics-to-manage-your-application-security-program-sans-veracode.pdf
- 23. © 2019 VERACODE INC. Veracode’s Top Five Programme Metrics
- 24. © 2019 VERACODE INC. #1 : Your Flaw Density • Allows appropriate focus on expansion of developer training activities • Securing third-party software • Identifying vulnerable components or libraries USE CASE Reports where the most code flaws are seen WHAT
- 25. © 2019 VERACODE INC. #2 : Your Fix Rate • Allows appropriate focus on expansion of developer training activities • Augment your development team using advisors or security champions • Redirect funds toward remediation activities USE CASE How long it takes you to fix vulnerabilities WHAT
- 26. © 2019 VERACODE INC. #3 : Your Rank in AppSec Maturity Models • Identify gaps in your programme based on the lessons learned by others and best practices • Expanding your programme to remain competitive USE CASE How do you compare to industry leaders and best practices WHAT
- 27. © 2019 VERACODE INC. #4 : Your Compliance with Industry Regulations • Code reviews built into the SDLC • Both manual and automated assessments • Controls around 3rd party software • Gap analysis • Continuous verification USE CASE Whether you are meeting relevant industry regulations WHAT
- 28. © 2019 VERACODE INC. #5 : Your Compliance with Internal Policies • Provide additional developer training • Gap analysis • Continuous verification • Augment your development team using advisors or security champions USE CASE Whether you are meeting your internal policies WHAT
- 29. © 2019 VERACODE INC. Metrics Used in My Deutsche Bank Programme “What percentage of applications are covered by the AppSec programme? ”What percentage of applications are compliant with the AppSec policy?”
- 30. © 2019 VERACODE INC. Findings From Our Customers Forrester TEI report
- 31. © 2019 VERACODE INC. SANS AppSec ROI Report https://www.veracode.com/blog/managing-appsec/optimizing-your- appsec-investment-value-stream-mapping
- 32. © 2019 VERACODE INC. Investment Decision Making
- 33. © 2019 VERACODE INC. Simple Return on Investment Model
- 34. © 2019 VERACODE INC. Forrester Total Economic Impact Report https://info.veracode.com/analyst-report-forrester-the- total-economic-impact-study.html
- 35. © 2019 VERACODE INC. Research Methodology
- 36. © 2019 VERACODE INC. Results Take Time
- 37. © 2019 VERACODE INC. Analysis of Benefits
- 38. © 2019 VERACODE INC. Doing More with a Smaller Team
- 39. © 2019 VERACODE INC. Reduce Costs of 3rd Party Testing
- 40. © 2019 VERACODE INC. Analysis of Costs
- 41. © 2019 VERACODE INC. Invest in Automation Upfront
- 42. © 2019 VERACODE INC. The Journey to a Mature Programme A route to maturity
- 43. © 2019 VERACODE INC. Four Stages to a Mature Programme Reactive • Fire fighting mode • Responding to emergencies • Limited scale and scope Baseline • Wider coverage • More comprehensive assessments • Greater measure of control and KPIs Expanded • Fully integrated into the SDLC • AppSec is seen as BAU Advanced • More nuanced in approach to tools and teams • Highly integrated in a DevSecOps approach
- 44. © 2019 VERACODE INC. Demonstrate a Vision for Your Programme
- 45. © 2019 VERACODE INC. Future Proofing Your Business Invest for the future
- 46. © 2019 VERACODE INC. Dev(Sec)Ops and Automation https://dzone.com/articles/devops- trends-2019-what-you-need-to-know
- 47. © 2019 VERACODE INC. Security as a Competitive Advantage / Requirement https://www.capgemini.com/2018/05/cybersecurity-the-new- competitive-advantage-for-retailers/
- 48. © 2019 VERACODE INC. Top Takeaways to Remember • Fight for more of the budget pie • Plan on expanding the budget pie • Pick metrics that matter to your business • Benchmark against your peers/competitors • Pick solutions that allow automation • Invest upfront to automate to achieve long term ROI • Don’t expect instant gratification !
- 49. © 2019 VERACODE INC. Get In Touch • Follow up via the Brighttalk page • Follow up with the point of contact in your registration email • Please do @ me on Twitter : @colindomoney
- 50. © 2019 VERACODE INC.