In our next webinar, Simon Roe Product Manager at Outpost24 will discuss how you can create greater and more robust visibility of security within the application development lifecycle.

1. Creating a sustainable application
security program to drive growth
Simon Roe, Product Manager
July 2019

2. Poll 1: How mature is your application security program?
• Comprehensive program covers nearly all applications
• Some automated tools and processes for critical applications
• We run penetration tests as needed
• We don't have a program
2

3. Focus on risk
3
Infrastructure Application
Data
Business

4. State of application security
Why application hacking attacks?
• More applications
• Changing development process
• More cloud deployment
• It’s easy
4
Source: Verizon, 2019 Data Breach Investigations Report

5. Developed in-house
Developed externally
Commercial applications
Commercial apps with customization
Acquisition
5
Application sources

6. Align with business goals
Reduce exposure
Repeatable process
Expected outcomes 6

7. Poll2: How many applications in your organization?
• Tens
• Hundreds
• Thousands
• Unknown
7

8. Security assessment workflow 8
Identify what you own
Assess where it is weak
Focused risk reduction

9. Application Security Program in detail 9
Discovery
Scoring
AlignmentOnboarding
Assessment
CMDB
Customer
ASP

10. Automate discovery
Proxies for business criticality
Establish ownership
Recurring process
Discover and catalog application assets 10

11. Apply a ‘risk score’
• What defines risk (or criticality)?
• Different for each organisation but
likely based on business impact
• Assess each discovered application
against this metric
11

12. Application security testing tools 12
Static - SAST Dynamic - DAST
Hybrid – Human /
Machine
Mobile - MAST Composition - SCA Bug Bounty

13. Application lifecycle 13
ProductionPre-production
Development
/DevOps

14. Application lifecycle 14
ProductionPre-production
Development
/DevOps
education
tools that work on code
SAST, MAST, SCA
tools that work on apps
DAST, Hybrid, Bounty
Infrastructure assessment tools

15. Don’t neglect Education (but make it fun) 15

16. Monitor and reduce risk to the business 16

17. KPI’s matter
• Different for different groups
• Security : Risk in terms of vuln criticality
• Board: Risk in terms of fiscal and reputational impact to business
• DevOps : bugs needing fixing
• Build dashboards and reports to meet all interested parties KPI’s
17

18. Takeaways
Discovery leads to more work
• More than expected
• Manual process to find owners and establish criticality
Scope will evolve
• External exposure is a logical starting point
• But internal apps may be just as much work
Metrics are key
• Essential to stay focused on risk
• Management interest in outcomes of investment
18

19. About us

20. Our solution protects your web apps by reducing
risk exposure, offering flexibility to fit with your
Devopps cycle to meet business goals.
Our tools are best in class and ensure your assets
are always protected leaving you time to make
informed business decisions.
.
20

21. Simon Roe
Product Manager
sro@outpost24.com
+44 (0)7825 913295
Q & A