App sec prioritization is priority No. 1 for CISOs

As application security and DevSecOps teams try to get the most bang for their app sec buck, one of the perennial problems has been figuring out where to focus their secure coding and vulnerability remediation efforts.

The scale of vulnerabilities that must be chased down in each application and the extent of the code that stretches across a typical enterprise portfolio of applications (and the enterprise's attendant software supply chain) make deciding on even the first step of prioritization a complex affair.

For the better part of a year, app sec veteran Mark Curphey and his business partner John Viega, who have depth of experience in the app sec space, heard variations on this complaint time and again. Curphey founded OWASP and had a hand in founding the companies OpenRaven and SourceClear, acquired by Veracode. Viega founded Secure Software, which developed the app sec testing tool Fortify, bought by Hewlett-Packard.

Before launching their next venture, Curphey and Viega went on a listening tour with top CISOs to get at their biggest app sec pain points. Here is what they learned in those conversations.

Join Nov. 14 Webinar: Secure by Design: Why Trust Matters Learn more: Software Supply Chain Risk Report

Scan-and-fix is noisy and time-consuming

Curphey and Viega found general agreement that app sec leaders and their CISO bosses are faced with more and more noise as the complexity of scan-and-fix keeps rising.

We sat down with about 100 CSOs and we basically said, 'We're going to do an app sec company, so that's the scope, but within that what's your biggest unsolved problem?' And what we heard very consistently was, 'We've got all the money in the world. We've got all the tools in the world. We can hire people. But we have massive amounts of noise, so we don't know what we should work on.'

One recent study bolsters this point. In the survey, conducted among 300 security professionals by Backslash Security, 85% of respondents see being able to differentiate between real app sec risks and noise as critical to their success, but only 38% of them think their organization is able to do that. The biggest problem with their app sec tools? Almost half of the respondents (45%) said it was prioritizing findings, which takes a considerable amount of time given that they are "pretty noisy."