5 STEPS FOR CREATING AN APPSEC PROGRAM

Summary from the TLDR InfoSec newsletter

This post lays out 5 steps to building an AppSec program. Start by creating or updating application and infrastructure diagrams to engage security partners and gain visibility into the attack surface. Existing security tools should then be mapped to the diagrams. The limitations of those tools should be explored and then repeatable processes should be built around security. After a program reaches this level of maturity, further projects such as secure libraries, terraform modules, and DAST integrations can be pursued.