{"id":5279,"date":"2023-07-05T14:28:04","date_gmt":"2023-07-05T18:28:04","guid":{"rendered":"https:\/\/solutionsreview.com\/network-monitoring\/?p=5279"},"modified":"2023-09-07T14:35:50","modified_gmt":"2023-09-07T18:35:50","slug":"the-future-of-appsec-depends-on-force-multiplying-talent","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/network-monitoring\/the-future-of-appsec-depends-on-force-multiplying-talent\/","title":{"rendered":"The Future of AppSec Depends on Force Multiplying Talent"},"content":{"rendered":"

\"AppSec\"<\/p>\n

Solutions Review\u2019s\u00a0Contributed Content Series<\/u><\/a>\u00a0is a collection of contributed articles written by thought leaders in enterprise software categories. Peter Morgan of Phylum<\/a> predicts that the future of AppSec depends on successfully force-multiplying the talent pool.<\/em><\/strong><\/p>\n

To plan for the future of Application Security (AppSec), we must rethink our ability to hire and retain talent. Ahead of the economic downturn of 2022, Application Security roles had double-digit negative unemployment rates. These roles were difficult to fill due to the number of roles open, and the challenging experience required by them. These variables caused compensation to skyrocket, and massive tech companies will scoop up more of this small skilled talent pool, leaving gaps for everyone else. This paints a picture of the future reality where application security programs cannot scale as they exist today. There simply is not enough talent to go around for everyone without change. To solve this, we need to consider how AppSec engineers can become force multiplied.<\/p>\n

One of the shifts AppSec will need to make is the proper use of tools to enable skilled AppSec engineers to cover many more developers than they currently can. To accomplish this, we’ll need to consider changes in the software development process to assist this effort.<\/p>\n

In the market for AppSec solutions? Check out our free Buyer’s Guide<\/strong><\/a>!<\/p><\/div>\n

The Future of AppSec<\/strong><\/h2>\n
\n

Standardized Development Languages<\/strong><\/h3>\n

The shift to microservices changed the landscape for how companies write software, hire developers and manage their infrastructure. Microservices brought the idea that developers can use the best language for the job, as long as the API contract is upheld. This was a tremendous improvement in many ways. Unfortunately for security tooling, this effectively destroyed the Static Analysis Security Testing (SAST) category of tools.<\/p>\n

Back in the day, companies had \u201chouse languages.\u201d If you worked there, you either wrote in C, C++, Java, or .NET for the most part. House languages were great for SAST tools, because it meant a smaller set of language support to reach that ever-so-critical inflection point of value to customers of SAST. Microservices changed everything. Today\u2019s application from 40,000 feet is spread across many more languages. While there is a benefit to mapping the right language for the job, some of this sprawl comes from developer experience (DX). Developer experience sprawl can be seen in both choice of source code language, and choice of in-language framework. Merits aside, this presents significant difficulties in successfully using SAST and Dynamic Analysis (DAST) security tools.<\/p>\n

Effective static analysis is one of the most challenging problems in both computer security and computer science. Most of this stems from the deep analysis required to identify a meaningful amount of vulnerability classes. Yet, if you poll the product satisfaction of a group of engineers forced to use SAST products, you will likely be cleaning yourself off from the vomit of complaints of false positives. This problem might seem more tractable with recent advances, except for the sprawling language requirements most companies now have. SAST products struggle to maintain the breadth of language support while providing the depth analysis capability needed to provide customer value.<\/p>\n

Standardized Development Frameworks<\/strong><\/h3>\n

Along with the shift to microservices that weakened the value of SAST tools to security teams, DAST has experienced a similar issue, albeit related to software frameworks used to rapidly architect software products. The explosion in the number of frameworks used by companies today means it\u2019s extremely difficult for DAST product vendors to do a good job on a small set that provides lots of value to their customers. This is similar to the depth vs. breadth problem in SAST.<\/p>\n

DAST tooling usually needs to understand how data flows through an application and where security boundaries live. DAST is a bit like setting up a debugger on the target software and recording the analysis during runtime to identify violations of security controls but in a highly automated environment. If you must customize for application, it will be untenable to the speed of development. Often in the past, DAST products were\/could be developed around development frameworks, such as Python\u2019s Django or Ruby on Rails.<\/p>\n

I argue that a significant percentage of the language and framework choices made over the past five years have been more for developer experience (DX) than for the project’s needs. DX-driven choices in the framework became drastically less impactful once microservices had already weakened the utility of the then-current state of SAST capability. We can reign in the framework sprawl through standardization and enable DAST tools to provide additional value to our AppSec engineers.<\/p>\n

A Foundation for Solving Modern AppSec Challenges<\/strong><\/h3>\n

AppSec approaches will need to evolve in order to solve future challenges. Standardizing to both a reduced set of accepted development languages and a reduced set of accepted frameworks will enable security tools to empower AppSec engineers through force multiplication. Awareness and planning in advance can enable streamlined access to the future state where AppSec is more resilient to staffing challenges and the ever-increasing speed of software development.<\/p>\n

\t\t\t

\"Download<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div>\n","protected":false},"excerpt":{"rendered":"

Solutions Review\u2019s\u00a0Contributed Content Series\u00a0is a collection of contributed articles written by thought leaders in enterprise software categories. Peter Morgan of Phylum predicts that the future of AppSec depends on successfully force-multiplying the talent pool. To plan for the future of Application Security (AppSec), we must rethink our ability to hire and retain talent. Ahead of […]<\/p>\n","protected":false},"author":750,"featured_media":5280,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1,21],"tags":[],"acf":[],"yoast_head":"\nThe Future of AppSec Depends on Force Multiplying Talent<\/title>\n<meta name=\"description\" content=\"Peter Morgan of Phylum predicts that the future of AppSec depends on successfully force multiplying the talent pool.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/network-monitoring\/the-future-of-appsec-depends-on-force-multiplying-talent\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"The Future of AppSec Depends on Force Multiplying Talent\" \/>\n<meta property=\"og:description\" content=\"Peter Morgan of Phylum predicts that the future of AppSec depends on successfully force multiplying the talent pool.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/solutionsreview.com\/network-monitoring\/the-future-of-appsec-depends-on-force-multiplying-talent\/\" \/>\n<meta property=\"og:site_name\" content=\"Best Network Monitoring Vendors, Software, Tools and Performance Solutions\" \/>\n<meta property=\"article:published_time\" content=\"2023-07-05T18:28:04+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-09-07T18:35:50+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/solutionsreview.com\/network-monitoring\/files\/2023\/07\/The-Future-of-AppSec-Depends-on-Force-Multiplying-Talent.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"400\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Peter Morgan\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Peter Morgan\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/the-future-of-appsec-depends-on-force-multiplying-talent\/\",\"url\":\"https:\/\/solutionsreview.com\/network-monitoring\/the-future-of-appsec-depends-on-force-multiplying-talent\/\",\"name\":\"The Future of AppSec Depends on Force Multiplying Talent\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/the-future-of-appsec-depends-on-force-multiplying-talent\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/the-future-of-appsec-depends-on-force-multiplying-talent\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/network-monitoring\/files\/2023\/07\/The-Future-of-AppSec-Depends-on-Force-Multiplying-Talent.jpg\",\"datePublished\":\"2023-07-05T18:28:04+00:00\",\"dateModified\":\"2023-09-07T18:35:50+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/#\/schema\/person\/8b055fbe7988c820eae7782a4380d368\"},\"description\":\"Peter Morgan of Phylum predicts that the future of AppSec depends on successfully force multiplying the talent pool.\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/the-future-of-appsec-depends-on-force-multiplying-talent\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/network-monitoring\/the-future-of-appsec-depends-on-force-multiplying-talent\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/the-future-of-appsec-depends-on-force-multiplying-talent\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/network-monitoring\/files\/2023\/07\/The-Future-of-AppSec-Depends-on-Force-Multiplying-Talent.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/network-monitoring\/files\/2023\/07\/The-Future-of-AppSec-Depends-on-Force-Multiplying-Talent.jpg\",\"width\":800,\"height\":400,\"caption\":\"AppSec\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/the-future-of-appsec-depends-on-force-multiplying-talent\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/network-monitoring\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"The Future of AppSec Depends on Force Multiplying Talent\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/#website\",\"url\":\"https:\/\/solutionsreview.com\/network-monitoring\/\",\"name\":\"Best Network Monitoring Vendors, Software, Tools and Performance Solutions\",\"description\":\"Solutions Review Network Monitoring\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/network-monitoring\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/#\/schema\/person\/8b055fbe7988c820eae7782a4380d368\",\"name\":\"Peter Morgan\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/b3c54f4e3af6194f28353848e3ec188d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/b3c54f4e3af6194f28353848e3ec188d?s=96&d=mm&r=g\",\"caption\":\"Peter Morgan\"},\"description\":\"Pete Morgan is a co-founder and CSO of Phylum. He is a recognized security researcher and entrepreneur with over 20 years of experience in information security, software development, and executive leadership. Prior to Phylum, Pete held senior roles at Matasano Security, Accuvant, and Optiv, and holds a B.S. in computer science from the University of Wisconsin Oshkosh.\",\"url\":\"https:\/\/solutionsreview.com\/network-monitoring\/author\/pmorgan\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"The Future of AppSec Depends on Force Multiplying Talent","description":"Peter Morgan of Phylum predicts that the future of AppSec depends on successfully force multiplying the talent pool.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/network-monitoring\/the-future-of-appsec-depends-on-force-multiplying-talent\/","og_locale":"en_US","og_type":"article","og_title":"The Future of AppSec Depends on Force Multiplying Talent","og_description":"Peter Morgan of Phylum predicts that the future of AppSec depends on successfully force multiplying the talent pool.","og_url":"https:\/\/solutionsreview.com\/network-monitoring\/the-future-of-appsec-depends-on-force-multiplying-talent\/","og_site_name":"Best Network Monitoring Vendors, Software, Tools and Performance Solutions","article_published_time":"2023-07-05T18:28:04+00:00","article_modified_time":"2023-09-07T18:35:50+00:00","og_image":[{"width":800,"height":400,"url":"https:\/\/solutionsreview.com\/network-monitoring\/files\/2023\/07\/The-Future-of-AppSec-Depends-on-Force-Multiplying-Talent.jpg","type":"image\/jpeg"}],"author":"Peter Morgan","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Peter Morgan","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/network-monitoring\/the-future-of-appsec-depends-on-force-multiplying-talent\/","url":"https:\/\/solutionsreview.com\/network-monitoring\/the-future-of-appsec-depends-on-force-multiplying-talent\/","name":"The Future of AppSec Depends on Force Multiplying Talent","isPartOf":{"@id":"https:\/\/solutionsreview.com\/network-monitoring\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/network-monitoring\/the-future-of-appsec-depends-on-force-multiplying-talent\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/network-monitoring\/the-future-of-appsec-depends-on-force-multiplying-talent\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/network-monitoring\/files\/2023\/07\/The-Future-of-AppSec-Depends-on-Force-Multiplying-Talent.jpg","datePublished":"2023-07-05T18:28:04+00:00","dateModified":"2023-09-07T18:35:50+00:00","author":{"@id":"https:\/\/solutionsreview.com\/network-monitoring\/#\/schema\/person\/8b055fbe7988c820eae7782a4380d368"},"description":"Peter Morgan of Phylum predicts that the future of AppSec depends on successfully force multiplying the talent pool.","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/network-monitoring\/the-future-of-appsec-depends-on-force-multiplying-talent\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/network-monitoring\/the-future-of-appsec-depends-on-force-multiplying-talent\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/network-monitoring\/the-future-of-appsec-depends-on-force-multiplying-talent\/#primaryimage","url":"https:\/\/solutionsreview.com\/network-monitoring\/files\/2023\/07\/The-Future-of-AppSec-Depends-on-Force-Multiplying-Talent.jpg","contentUrl":"https:\/\/solutionsreview.com\/network-monitoring\/files\/2023\/07\/The-Future-of-AppSec-Depends-on-Force-Multiplying-Talent.jpg","width":800,"height":400,"caption":"AppSec"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/network-monitoring\/the-future-of-appsec-depends-on-force-multiplying-talent\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/network-monitoring\/"},{"@type":"ListItem","position":2,"name":"The Future of AppSec Depends on Force Multiplying Talent"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/network-monitoring\/#website","url":"https:\/\/solutionsreview.com\/network-monitoring\/","name":"Best Network Monitoring Vendors, Software, Tools and Performance Solutions","description":"Solutions Review Network Monitoring","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/network-monitoring\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/network-monitoring\/#\/schema\/person\/8b055fbe7988c820eae7782a4380d368","name":"Peter Morgan","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/network-monitoring\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/b3c54f4e3af6194f28353848e3ec188d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/b3c54f4e3af6194f28353848e3ec188d?s=96&d=mm&r=g","caption":"Peter Morgan"},"description":"Pete Morgan is a co-founder and CSO of Phylum. He is a recognized security researcher and entrepreneur with over 20 years of experience in information security, software development, and executive leadership. Prior to Phylum, Pete held senior roles at Matasano Security, Accuvant, and Optiv, and holds a B.S. in computer science from the University of Wisconsin Oshkosh.","url":"https:\/\/solutionsreview.com\/network-monitoring\/author\/pmorgan\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/posts\/5279"}],"collection":[{"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/users\/750"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/comments?post=5279"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/posts\/5279\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/media\/5280"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/media?parent=5279"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/categories?post=5279"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/tags?post=5279"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}