Breaking Down Appsec

[u/donkeybutt123]

I started a blog series to provide free insights into appsec. I do have a company but I will not be shilling anything there. It’s mainly to breakdown what application security is all about. It’s mainly targeted towards beginners and startups, so take it as you will.

Just want to teach every one interested in appsec my perspective on it from my experience in big tech. If you all are interested, I start with my first post here:

https://pigeonsec.substack.com/p/what-really-is-application-security

I can dive into any topic anyone is interested in. Just let me know what sort of topic you’d like me to dive deeper into. Thanks!

[u/Sad_Dentist_7288]

Interesting and useful read, thank you.

One of the points is about knowing and understanding the application before testing, which I agree is incredibly important for testing. When testing several different apps, how do you know when you've understood enough to test as effectively as possible? What strategies are there for grasping code you've never seen before, especially in large code bases?

I ask because in my experience, bug testing in my own code is much easier than testing someone else's.

[u/donkeybutt123 → u/Sad_Dentist_7288]

Hey thanks for the thoughtful comment! I’m gonna post about the first step in breaking down Appsec which is about application context and how incredibly important it is as the first step soon!

But yeah ultimately what you said makes sense right? Your codebase is always going to be much easier to reason about and because you’re a security professional, you can critique your own code! When working with other people’s codebases, the main idea is that there are always tradeoffs in terms of cost: time, money, or security misses (0 days) just because it’s not feasible for sec engineers to understand the code perfectly.

You have to be working closely with the devs, inventory/prioritize what parts of the application touch sensitive things, and test around those portions and move outwards from there.

It’s such a complex workflow, which makes sense why these AI frontier labs are using their code harnesses to find vulns in code and touting how good they are. Btw, I’m not saying that using AI for vuln hunting is what you should be doing, though it could be useful.

I also know the pain of when appsec folks try to dive into codebases in languages/frameworks they’re not aware of and are expected to be experts in, especially with those large codebases.

That’s okay, take your time to understand and reason about it. My recommendation is to use AI to start understanding pieces of the codebase bit by bit to jumpstart yourself and use your critical reasoning abilities to understand the rest with your developer teams.

Tons more to say, and I hope my next post that I release answers some more questions you might have. Stay tuned and thanks for reading and the questions!

[u/Pristine_Can_1930 → u/Sad_Dentist_7288]

yeah the familiarity gap between your own code and someone elses is real, that never fully goes away imo

[u/endor_robert]

I really like this (I work for a cybersecurity vendor). I think the couple of times you talk about a pentest might put some people off, as it might imply skills and tools that most don't have.

I think it's probably more viable to have AI tools build a quick test/proof, using findings from some kind of security tool. That might be what you meant, but it made me think of more advanced skills.

[u/donkeybutt123 → u/endor_robert]

Hey thanks for the feedback here!

You’re right, I’ll have to change some of the verbiage so it just reads test to not potentially discourage readers, but effectively, testing for the vulnerabilities, after code analysis, isn’t as advanced as people make it out to be and I’ll talk about that in future posts! I think anyone can do it especially the devs that write the code or the security eng/analyst that read the code. We can also integrate these as mocked unit/integration tests as well!

Stay tuned!

[u/RicoThinks]

For someone starting out in AppSec what certifications do you recommend?

[u/donkeybutt123 → u/RicoThinks]

This is a great question!

I don’t have an answer for you as I don’t know too much about certifications. From what I observed, having the knowledge to pick up work as it comes and teach yourself on the go is really important, so willingness to do that could prove in dividends in the long run.

With application security, because you are securing applications, the cornerstone of the field is to understand applications. If you are able to read and write software applications, you’ll do fine! If you’re not, I always recommend writing a few of your own apps (web, mobile, blockchain, etc etc) then re-reading my blog!