97 Things Every Application Security Professional Should Know

Chapter 3. AppSec Must Lead

Brook S.E. Schoenfield

Someone must take responsibility and be accountable for security, especially for AppSec. Foremost, most people who have some role related to the production and operation of software often have limited or even no AppSec knowledge. Couple that reality with the complexity of our state-of-the-art AppSec requirements and practices, and what we have is a vacuum that cannot be filled simply by telling engineering, product management, project managers, and developers to “make code secure.”

Someone has to lead.

Leadership is earned, never merely given. While many roles will specify a “leadership” component or requirement, true leadership is recognized by what each of us does. Leaders are those people who take responsibility and put themselves forward as accountable for the impacts and consequences, not just of their own actions but the results of collective effort. I don’t mean just taking credit for successes; in fact, great leaders are happy to assign credit to everyone who contributes.

Leadership may not be about holding decision-making power. In fact, a task typically enacted by a security team is identifying and rating risks. But the risk decisions often must not be taken by those same people; it is their very independence from accountability for risk decisions that allows security folk the freedom to accurately build a risk picture. ...