OWASP 2024 Global AppSec San Francisco

In the fast-evolving world of cybersecurity, managing an application security (AppSec) program can feel like running a marathon—a test of endurance, strategy, and continuous improvement. This presentation draws insightful parallels between marathon running and effective AppSec management, demonstrating how the principles of disciplined training, strategic pacing, and incremental progress can lead to long-term success.


Over the past five years, the speaker has completed seven marathons and has qualified for the prestigious Boston Marathon next year. With more than a decade of experience in building application security programs for various companies, they bring a unique perspective to bridging the gap between these two demanding fields.


Mindset and goal setting are critical for success in both marathon running and AppSec programs. We will explore the essential tools and techniques that both marathon runners and AppSec professionals need to optimize performance and achieve their goals. For instance, choosing the right footwear—whether it's the Nike ZoomX Vaporfly or the Adidas Ultraboost—and leveraging SAST, DAST, and SIEM systems can significantly impact outcomes.


Moreover, the session will delve into targeted training methodologies such as interval training and long runs, translated into AppSec practices like threat modeling and regular security audits. Attendees will learn the importance of continuous monitoring and feedback mechanisms—whether it's through wearables and performance metrics or automated testing and security dashboards.


Adaptation and evolution are crucial in both fields. Just as runners adjust to varying conditions and integrate innovative techniques, AppSec programs must adapt to emerging threats and incorporate state-of-the-art technologies. We'll share real-world examples showcasing how these adaptations can lead to improved security postures.


We will also cover some commonly seen pitfalls for both marathon runners and those managing application security programs. Understanding these pitfalls can help avoid setbacks and ensure a smoother path to success.


Collaboration and knowledge sharing form the backbone of success in both marathon running and application security. This presentation will highlight the role of running communities, expert consultations, and workshops in fostering growth and resilience. Similarly, it will emphasize the importance of cross-team collaboration, industry engagement, and internal training sessions in cultivating a robust AppSec culture.


Key Takeaways:

1. Believe in Yourself: Anyone can run a marathon and anyone can run an application security program with the right mindset.
2. Realistic Goals and Concrete Plans: Setting realistic goals and concrete plans is essential for both your marathon and your application security program.
3. Enjoy the Process and Have Fun: Enjoying the process and having fun can make the journey more rewarding.

Join us to discover how to navigate your journey from the start line to the security finish, ensuring that your application security program is not only resilient but also continuously evolving, much like a marathon runner training for the ultimate race.