Latest / The Application Security Podcast / Francesco Cipollone -- Application Security Posture Management and the Power of Working with the Business

Transcript

Francesco Cipollone -- Application Security Posture Management and the Power of Working with the Business · The Application Security Podcast

• 0:00
  Chris Romeo: Francesco Chip Malone is a seasoned entrepreneur, CEO of Phoenix Security, a contextual based vulnerability management platform, and the host of the Multi-Award winning Cybersecurity and Cloud podcast.
• 0:13
  Chris Romeo: As an author, speaker, and visionary in the cybersecurity industry, he serves as chapter chair for UK and I of the Cloud Security Alliance.
• 0:21
  Chris Romeo: Previously, Francesco led application and cloud security at HSBC and was a senior security consultant at AWS.
• 0:30
  Chris Romeo: He has keynoted at global conferences and authored several books.
• 0:33
  Chris Romeo: Outside work, Francesco enjoys running marathons, snowboarding in Italy, and savoring a single malt whiskey in his favorite London clubs.
• 0:43
  Chris Romeo: He joins us in exploring application security posture management and its distinction from classic SIEM solutions.
• 1:33
  Chris Romeo: Hey folks, welcome to this episode of the Application Security Podcast.
• 1:37
  Chris Romeo: This is Chris Romeo.
• 1:38
  Chris Romeo: I'm the CEO of Devici, also a general partner at Kerr Ventures, and joined by my good friend Robert Hurlbutt.
• 1:46
  Chris Romeo: Hey Robert.
• 1:47
  Robert Hurlbut: Hey, Chris.
• 1:48
  Robert Hurlbut: Yeah.
• 1:48
  Robert Hurlbut: Robert Hurlbut, principal application security architect and threat modeling lead at Aquia.
• 1:53
  Robert Hurlbut: And great to be here again to talk about application security.
• 1:57
  Chris Romeo: Yeah, and we're going to learn about a new category here today.
• 1:59
  Chris Romeo: Um, that it's, it's a category that I've been curious about, but I feel like I Don't know enough about it yet.
• 2:06
  Chris Romeo: So, but before we do that, we have Frank from Phoenix Security who's going to start by sharing his security origin story with us because we always start there and we want to know where people are Coming from so Frank welcome to the show and please dive right into your security origin story or how you got into this world of security.
• 2:26
  Francesco Cipollone: so thank you Chris Thank you Robert for having me on the show.
• 2:29
  Francesco Cipollone: I actually started my life not as a security person but as a developer and I started working very early in the days on Uh, I don't know if you remember or who remembers of the audience, the very early origin of virtualization that was on QM or KVMSEC and Xen.
• 2:50
  Francesco Cipollone: And I started really hacking between, uh, hosts and operating system.
• 2:55
  Francesco Cipollone: And that's what got me really interested into the intricacies and deep down into the how things were built and how things were broken up together.
• 3:04
  Francesco Cipollone: Um, and from there that kind of switch between that and the traditional world of security that was starting building up Um, and I started my career as a trainer as well Uh, so after that I started working as a trainer because just as a software developer You didn't make enough money and Cisco and Microsoft had wonderful training So I started diving a little bit deeper in the network, Microsoft, and security was really interesting Attracting me because it was breaking stuff, but it's also was so early in the days that people didn't even know what security meant So it really got me into a passion of actually explaining what it was and what really got me into security is It is actually nothing else than doing things right.
• 3:48
  Francesco Cipollone: So as a developer, as a system operator, or as a network configurator, I saw security as building up things in the right way, telling people the right things to do.
• 4:00
  Francesco Cipollone: and helping them on that journey.
• 4:02
  Francesco Cipollone: So, and as a trainer, it kind of got me into that mindset.
• 4:06
  Francesco Cipollone: And from there, I actually start working more and more in security.
• 4:13
  Francesco Cipollone: So my first baby, there was a training company back in the day.
• 4:16
  Francesco Cipollone: So Chris, that's my affinity with you.
• 4:21
  Francesco Cipollone: And then I started fundamentally helping organization moving to the cloud and security was a very big thing.
• 4:27
  Francesco Cipollone: And the cloud were not safe.
• 4:29
  Francesco Cipollone: the cloud that we have today.
• 4:30
  Francesco Cipollone: So they were very scripty, very bulky, very rough around the edges.
• 4:36
  Francesco Cipollone: I don't know if anybody dealt with Microsoft at the very early days, but was nothing like we have today.
• 4:42
  Francesco Cipollone: It was a lot of programming, PowerShell script, and other stuff.
• 4:45
  Francesco Cipollone: AWS still is, but I spent most of my life helping organization.
• 4:50
  Francesco Cipollone: kind of shifting in an intelligence way things to the cloud.
• 4:54
  Francesco Cipollone: And the first thing that usually happen is application weren't built in the right way for the cloud.
• 5:00
  Francesco Cipollone: So you build this nice, secure structure for the cloud with the right access control, and then you throw in the first couple of application and everything break loose, and then you start opening everything up.
• 5:14
  Francesco Cipollone: And that's, uh, and that's interesting because it, it kind of pushes you to a trade off, um, but in this story, basically, the more I went into it, the more I started seeing the convergence between, uh, software and cloud into one thing, um, and it probably peaked where I was leading the application security and cloud security for HSBC, where I was trying to bridge the two gaps together, and that's a little bit the origin story of where Phoenix was born, and the whole ASPM category was born, because I was trying to relate to the business overall, what was an application and what, what was that application running and letting them making a decision based on risk metrics and translating a very complicated concept that is fundamentally software running somewhere into very simple things like this is a product.
• 6:07
  Francesco Cipollone: So I think that's, That's my love for product security.
• 6:10
  Francesco Cipollone: That's where product security was born, uh, as an idea to actually paint a picture of what you build, where you run it, and communicating that to the business.
• 6:19
  Francesco Cipollone: That is a very tricky thing to do because you need three vertical into your brain, the business aspect, the security aspect, um, and a little bit development aspect.
• 6:32
  Francesco Cipollone: And it's very, very few people have it nowadays.
• 6:37
  Chris Romeo: So you just mentioned something that's, that's, I've asked this question of a number of different guests over the last six months, because this topic keeps coming up.
• 6:46
  Chris Romeo: You mentioned application security and you mentioned product security, both in the same.
• 6:50
  Chris Romeo: in the same vein.
• 6:51
  Chris Romeo: And in your mind, in your definition, what's the difference between application security and product security?
• 7:01
  Francesco Cipollone: That's a very good question.
• 7:03
  Francesco Cipollone: A lot of questions.
• 7:06
  Francesco Cipollone: I think application security is still close to pen testing and to the old school software security where product security kind of paint a better picture of how applications are built right now holistically, and it also paints a picture of how you communicate with the business.
• 7:26
  Francesco Cipollone: So I think application security paints an old picture of what we build right now versus product security is more in line with what application security is today.
• 7:37
  Francesco Cipollone: So for me, product security is an evolution of the whole application security where application security was just living in the code or maybe living in pentesting web and API while product security look at the product holistically and then application security just a component of it but also threat modeling but also risk assessment mitigation communicating to the business kind of describe that higher level figure that application security naturally evolved into it.
• 8:10
  Chris Romeo: That's helpful.
• 8:10
  Chris Romeo: I'm, I'm asking this question of lots of people because I'm, I'm wrestling with it as well.
• 8:15
  Chris Romeo: Like what, what's the difference?
• 8:17
  Chris Romeo: And so it's good, it's good to just get different perspectives.
• 8:21
  Francesco Cipollone: Well, what's the statistic between application security folks, uh, staying on application security versus product security?
• 8:29
  Chris Romeo: Yeah, I mean, most, uh, most of the, what I see in the industry right now, it's, it's most people are still holding court with the application security moniker.
• 8:39
  Chris Romeo: And, and part of that, I think I, and I see the world kind of that way, but part of it is I came out of Cisco where we were not application security, we were product security because we didn't make app, we made applications, I guess somewhere, but in general, we made products.
• 8:53
  Chris Romeo: We made metal boxes that routed packets and things.
• 8:56
  Chris Romeo: And so there was never, there was, we never thought of.
• 8:58
  Chris Romeo: The code that was running on it as an application.
• 9:01
  Chris Romeo: We thought of it as a holistic product to your point there.
• 9:04
  Chris Romeo: And so in my mind, that's kind of where I draw the line.
• 9:06
  Chris Romeo: It comes down to what are we, what are we selling?
• 9:09
  Chris Romeo: So like if I'm in a SAS business.
• 9:11
  Chris Romeo: I don't really do product security in my mind.
• 9:13
  Chris Romeo: I do application security because it's all about the application.
• 9:16
  Chris Romeo: We're not worried
• 9:17
  Francesco Cipollone: the application still runs on WAN.
• 9:19
  Chris Romeo: of course, but that's just, that's how I separate it.
• 9:22
  Chris Romeo: Yeah.
• 9:22
  Chris Romeo: That's how I separate it in my mind between, uh, but I think this is an evolving topic.
• 9:27
  Chris Romeo: It's an evolving thing that's happening, right?
• 9:30
  Chris Romeo: Like it's, it's, we're seeing the industry change and we've had a couple episodes.
• 9:34
  Chris Romeo: We had one whole episode that we talked with a couple of folks about the differences between it.
• 9:39
  Chris Romeo: And they shared their
• 9:40
  Francesco Cipollone: saw that.
• 9:41
  Chris Romeo: Inside their company, it broke down and how they've, how they have, they've defined it.
• 9:46
  Chris Romeo: So it's definitely a, uh, something, it's something that's going to continue to evolve over the next years.
• 9:51
  Francesco Cipollone: And just to throw a spanner in there, there is also platform security now as a term of people that all the infra people that maintains, uh, um, infrastructure container, some level of container and cloud.
• 10:06
  Francesco Cipollone: So you have application security people or product security people and then platform people.
• 10:12
  Chris Romeo: and see, I think of that as infrastructure security.
• 10:15
  Chris Romeo: That's the moniker that I use for that group.
• 10:17
  Chris Romeo: So, yeah, I mean, we've got some different groups in play here and, but it'll all, it'll all settle out.
• 10:24
  Robert Hurlbut: So Frank, today we're going to be talking about, uh, what is ASPM or application security posture management?
• 10:31
  Robert Hurlbut: Uh, what is that?
• 10:34
  Francesco Cipollone: Good question.
• 10:35
  Francesco Cipollone: Uh, And I think I would add, when is that?
• 10:40
  Francesco Cipollone: Because the definition of ASPM, or as we originally created it with Ghana, was XSPM, or Security Posture Star.
• 10:51
  Francesco Cipollone: Um, that was so wide as a category, uh, or Extended Security Posture Management, we created it at a certain point, we were revolving around that and chasm of, asset management as a broad category.
• 11:06
  Francesco Cipollone: But then I think it kind of evolved into, look, nobody knows what an application is, uh, and there is cloud security, posture management.
• 11:15
  Francesco Cipollone: There is infrastructure security, posture management of vulnerable or risk based vulnerability management.
• 11:20
  Francesco Cipollone: There isn't really a category for what's an application, what is the risk of an application, and.
• 11:26
  Francesco Cipollone: more extensive, where does an application run?
• 11:29
  Francesco Cipollone: And that's where really the term ASPM kind of was born.
• 11:33
  Francesco Cipollone: Now, because there is a whole substratum of organizations that do never had access to enterprise scanning tool like SAST, SCA, and so on.
• 11:45
  Francesco Cipollone: Kind of there was a second stream of ASPM category tools that just throw a bunch of open source tools together, string them along, and start calling them ASPM as well.
• 11:57
  Francesco Cipollone: So I think the category ASPM stuff fracturing.
• 12:00
  Francesco Cipollone: in two elements, organization or platform that orchestrate or scan or bring your own scanner information.
• 12:08
  Francesco Cipollone: Um, and kind of try to add intelligence and decision methods and then organization to just throw a bunch of scanner together.
• 12:16
  Francesco Cipollone: And then there is something in the, in the mix, in the middle.
• 12:19
  Francesco Cipollone: So I think that the ASPM category will evolve once more in the upcoming years of, Organizations that organize and add intelligence are on these assets that could come from different levels, from a cloud perspective, from a people perspective, from a software perspective, and organizations that purely scan, because I think there is a science in both of them, and you can't excel at both of them.
• 12:46
  Francesco Cipollone: That's why we had application security testing, really, where the ASPM, uh, with throwing a bunch of tools together should really land, uh, is, uh, testing, just stuff.
• 12:58
  Francesco Cipollone: And then the new modern things of actually building everything together is ASPM.
• 13:06
  Chris Romeo: So do you, let's, let's put the, the, let's go back in history, in time a little bit and have a little bit of a history perspective, because I want to get your take on whether you think ASPM is the new SIEM.
• 13:21
  Chris Romeo: And so Robert and I, you'll, people, well, no, people will notice that we have a gray tint to our, our hair, which means we've been around this industry for a long time.
• 13:30
  Chris Romeo: And, and so I remember when SIEMS became a thing.
• 13:34
  Chris Romeo: Um, I can never remember what they stand for, security incident event management, I think.
• 13:38
  Chris Romeo: Um, but they, they, in the information security side of the house, we had a, a, we started deploying all these different firewalls and IDS systems and all these different things that were generating all these alerts and they didn't go anywhere for a time period when they, after they came out.
• 13:57
  Chris Romeo: And then somebody had this idea to create this, Correlation engine, where we could bring up, we could point all these devices at this single thing.
• 14:05
  Chris Romeo: And then we as incident response people could, could trace this single central point of truth and we could correlate firewalls and IDSs and network routers.
• 14:16
  Chris Romeo: And, and we could see it in a single pane of glass to use a funny term that's never really come to fruition.
• 14:22
  Chris Romeo: Is ASPM the Application, the modern, is it, does it sit on top of what was developed in the world of SIEM and information security decades ago?
• 14:36
  Francesco Cipollone: I think yes, and I think risk based vulnerability management tried to attack that level, but it was kind of laser focus on just risk of specific vulnerability.
• 14:49
  Francesco Cipollone: While ASPM approached this problem because it's a wide problem.
• 14:53
  Francesco Cipollone: Um, into holistically, or if you approach ASPM right, like what we do, is looking at the asset and where they live, and what metadata they have, and then what problem they have, because fundamentally assets are just a bucket of problems.
• 15:05
  Francesco Cipollone: And you can quote me on that because it's my favorite sentence.
• 15:09
  Francesco Cipollone: Um, but that's kind of derived naturally on organizing those assets.
• 15:15
  Francesco Cipollone: uh, understanding who owns them and who drives them because attribution was the thing that was missing in CIEM.
• 15:22
  Francesco Cipollone: You have a bunch of stuff put together, but then so what, what do you do with this?
• 15:27
  Francesco Cipollone: And I think ASPM is great because it brings in the concept of attribution, or at least if you're doing ASPM right, um, you bring the concept of who needs to fix this stuff?
• 15:38
  Francesco Cipollone: Because just having a big data engine with just a bunch of data, um, is information is not inside, it's not actionable, while ASPM, I think, has a chance to take all of this problem, contextualizing, understanding really the nuances, taking the noise out that was something that the CM never did, um, and then routing them, um, to the right team to do some action.
• 16:03
  Francesco Cipollone: And at the same time, I think the element and the thing that we're trying to do is even pushing the boundary forward and saying, how can you involve the business to define the risk position where they want to operate and connect that to the engineering community?
• 16:17
  Francesco Cipollone: And that's, for me, is, is key and pivotal because otherwise it becomes a bucket of information and you can't action that bucket of information.
• 16:25
  Francesco Cipollone: Um, I think that's where the SIEM should have been, but then the problem is that from a SIEM perspective, it went into regulation, and hence the whole category became relaxed because everybody was buying SIEM, and you could charge that model, so there wasn't an incentive to evolve.
• 16:40
  Francesco Cipollone: And it kind of flattened out in the SOC, where the SOC were just saying, well, we need to have a SIEM because that's what a SOC is.
• 16:47
  Francesco Cipollone: Um, while ASPM is really driven by the necessity of, I have a bunch of tools that generate Information, and I have absolutely no clue about even who touched what, where, and should I focus on this or should I focus on that?
• 17:05
  Francesco Cipollone: So, I think yes.
• 17:07
  Francesco Cipollone: Long story short is ASPM is the natural glue between application security, asset management, risk based vulnerability management, and cloud security portion management.
• 17:19
  Francesco Cipollone: Now, if it's going to be absorbing, I don't know if it's going to be absorbing one way or another, like ASPM is going to become the new CSPM, or the CNAP is going to become ASPM plus CSPM, and I'm throwing a bunch of categories, but it's basically, if clouds security posture is going to become full stack security posture, or if the ASPM is going to become application security and cloud.
• 17:44
  Francesco Cipollone: Um, and I'm not even throwing data in that problem, because that's a whole category.
• 17:50
  Chris Romeo: I want to, I want to explore another avenue that you've mentioned because you've used the word business a couple times.
• 17:57
  Chris Romeo: in your descriptions of things.
• 18:00
  Chris Romeo: And I know you've, you've come from a large financial where you have experience doing this in the trenches.
• 18:06
  Chris Romeo: And I love to talk to people that have actually been in the trenches before been practitioners running programs and things.
• 18:12
  Chris Romeo: Cause I find I learned the most from, from hearing people's experiences, but I'm did, did, where did you, where did this idea about focusing on the business come from?
• 18:22
  Chris Romeo: Is this something you experienced in past leadership roles?
• 18:26
  Chris Romeo: Uh, where you, because I hear you talk about the business all the time.
• 18:29
  Chris Romeo: You're always, you're always bringing that back to the table.
• 18:31
  Chris Romeo: Whereas a lot of security people, we tend to forget that there's a business we work for.
• 18:35
  Chris Romeo: And they sign our paychecks at the end of the day.
• 18:38
  Chris Romeo: And we need to work with them and partner with them.
• 18:41
  Chris Romeo: So I guess where, you know, where did you get that, that kind of approach kind of built into how you think?
• 18:48
  Francesco Cipollone: Let me tell you a story on how we built a program of one of the largest cloud, a more treacherous cloud transformation in financial service ever.
• 18:57
  Francesco Cipollone: Um, we were, we were basically, we, triaging and dealing with millions of problems.
• 19:03
  Francesco Cipollone: And I had analysts to the, to my neck.
• 19:07
  Francesco Cipollone: We had a platoon of analysts working for me and we're trying to pair them up with engineers.
• 19:14
  Francesco Cipollone: The challenge is The more work we were doing, uh, and even if it was excellent work, first of all, it wasn't appreciated.
• 19:21
  Francesco Cipollone: And second of all, we couldn't steer the discussion from an engineering perspective in any direction because they weren't authorized to actually work on security.
• 19:29
  Francesco Cipollone: Security was a lip service things.
• 19:31
  Francesco Cipollone: We should move to the cloud securely.
• 19:33
  Francesco Cipollone: But what that actually meant is security requirement, threat modeling, fixing vulnerability, that didn't translate to the engineering.
• 19:40
  Francesco Cipollone: So it kind of faded away.
• 19:42
  Francesco Cipollone: And then it was a trend where the business was saying, we need to be secure.
• 19:46
  Francesco Cipollone: and then it kind of faded away.
• 19:47
  Francesco Cipollone: And from an engineering perspective, it's, yes, yes, we let them speak, and then fade away.
• 19:52
  Francesco Cipollone: So there was a translation problem between security and engineering, and engineering security and the business.
• 19:59
  Francesco Cipollone: So we were talking, we were kind of trying to aim for the same things that is making people survive on a digital infrastructure, but kind of not communicating in a synchronous way.
• 20:11
  Francesco Cipollone: And the only way I talked with my CEO, I said, the only way this can work, if the direction comes from top down, but I need to give you the tool to understand.
• 20:20
  Francesco Cipollone: First of all, Where are you sitting?
• 20:22
  Francesco Cipollone: How at risk you are?
• 20:23
  Francesco Cipollone: And then make an intelligence decision based on this information.
• 20:27
  Francesco Cipollone: Because if you don't have these insights and not data, you can't make a decision based on risk.
• 20:33
  Francesco Cipollone: You actually ask the business to express in a way that can't be translated in any way.
• 20:39
  Francesco Cipollone: So, that's what we did.
• 20:41
  Francesco Cipollone: We enabled the pieces to make risk based decisions that actually made sense from an engineering perspective.
• 20:46
  Francesco Cipollone: Not just risk quantification at the high level, not spreadsheet, but what we called GRC engineering.
• 20:52
  Francesco Cipollone: And that resonates with a lot of, some of the more advanced GRC community because you could represent risk in real time based on where the application were and based on where they were running.
• 21:02
  Francesco Cipollone: And then, Enabling the business, not in a generic way, but just literally setting a target, a bar, an OKR, so that they could express, I want to operate at this risk level, I'm comfortable at this risk level, how much work do I need to do to get to that risk level?
• 21:18
  Francesco Cipollone: And getting that message was extremely powerful because they could express, yes, I'm comfortable here, I'm comfortable here, I'm not comfortable here, just go and execute on this target.
• 21:29
  Francesco Cipollone: And then it wasn't a security requirement, was a business requirement, and as a security, we were using the data insights as aggregated and intelligence information to actually accelerate each engineering community to get to that target faster.
• 21:44
  Francesco Cipollone: So we were sitting in sprint call and saying, look, you guys have a problem of input validation.
• 21:49
  Francesco Cipollone: So let's use this particular library because it's going to accelerate.
• 21:52
  Francesco Cipollone: Instead of spending 15 story point on the next sprint, you could spend one story point or five story point upgrading, doing some regression testing, and here's a library.
• 22:01
  Francesco Cipollone: We went from the most hated thing.
• 22:03
  Francesco Cipollone: team in the most organization to actually the more in demand team from every organization because we were helping them achieving a business objective.
• 22:12
  Francesco Cipollone: And that's why I said, look, these things really work.
• 22:16
  Francesco Cipollone: And, and I looked around and there wasn't anything around that could give me that information or any tool that could give me that information.
• 22:24
  Francesco Cipollone: So we created one for us and that's a little bit of the origin story of Phoenix Security.
• 22:29
  Francesco Cipollone: Um, that was the name of the program, by the way.
• 22:32
  Francesco Cipollone: So we actually kept the name of the program.
• 22:34
  Francesco Cipollone: Uh, because it is, is is the logic of rebooting from the ashes of DevOps.
• 22:40
  Francesco Cipollone: So Phoenix security, Rebos from the ashes of DevOps, hence the Phoenix.
• 22:43
  Francesco Cipollone: And they actually, the logos are the GRC element of Phoenix, of, of what you have in our, in all these metrics.
• 22:50
  Chris Romeo: I've known you for a while and I've never heard that, I've never heard that story.
• 22:53
  Chris Romeo: So that's, that's interesting that, that, that was the company name came from the program name inside.
• 22:59
  Chris Romeo: So, um, yeah.
• 23:00
  Chris Romeo: Robert, why don't you continue, continue on the, help us continue on the path here.
• 23:05
  Robert Hurlbut: Sure.
• 23:05
  Robert Hurlbut: Uh, so one question we wondered about in terms of where, uh, talking further about where this came from is how does SBOM influence this space?
• 23:17
  Francesco Cipollone: I think when we started, first of all, it's a great question because I think as bomb.
• 23:24
  Francesco Cipollone: drives to the right business, um, and operational diligence.
• 23:32
  Francesco Cipollone: So it's creating asset information around your software, and I will even take it to the extreme of PBOM.
• 23:39
  Francesco Cipollone: So what, how does all of these assets intercorrelate together, get grouped together, and build a concept of asset lineage?
• 23:47
  Francesco Cipollone: So how do you build these things together, and how those things then evolve in new assets?
• 23:52
  Francesco Cipollone: Um, And that's kind of the concept and the things that we struggle with right now.
• 23:57
  Francesco Cipollone: Thinking about vulnerability instead of thinking about assets that inter correlate with each other and then evolve in other assets.
• 24:04
  Francesco Cipollone: And this is particularly important in the cloud where you think about an infrastructure as a whole that has vulnerabilities inherently because you're scanning for it and then you build it so those artifacts have an inerrant vulnerability in a specific stage, and then you deploy them.
• 24:19
  Francesco Cipollone: So those vulnerabilities that you discover with a CSPM in the cloud actually came all the way from that original asset.
• 24:26
  Francesco Cipollone: And if you think about it, SBOM started because we needed to have due diligence around asset management.
• 24:32
  Francesco Cipollone: It kind of got stopped in there.
• 24:35
  Francesco Cipollone: And I think that's where the role of ASPM can really play a part, because it's like organizing all these, all these, This concept of asset, and SBOM is what I call meta asset.
• 24:47
  Francesco Cipollone: Fundamentally, it's a library that belongs to a specific application, similar to what's installed software you have in infrastructure.
• 24:55
  Francesco Cipollone: So those are kind of meta assets that don't have a life in itself, but still are very important because, um, you need to understand how they are composed with each other because they inherently have vulnerabilities.
• 25:08
  Francesco Cipollone: And I think as long as some unit of entities have a vulnerability, that becomes a meta asset that live inside an asset, that then evolve in another asset.
• 25:17
  Francesco Cipollone: But all about it is asset vulnerability management that have different state and is very complicated.
• 25:25
  Francesco Cipollone: And how do you correlate that to A very simple term that is product is kind of the beauty of ASPM and where ASPM sits, of what you build and where you run it.
• 25:37
  Francesco Cipollone: And translating all this complexity into these beautiful things that is, this is the risk level of your product is where I think it's surprising for a lot of business to see where ASPM is.
• 25:49
  Francesco Cipollone: It's the wow factor of ASPM, I will say.
• 25:52
  Chris Romeo: Yeah.
• 25:52
  Chris Romeo: So let's, um, let, let's kind of summarize.
• 25:57
  Chris Romeo: When we think about the problems that ASPM is supposed to be solving for us, like how do we, how do we break that down into like two or three specific problems that this category of tooling is gonna sur gonna help us with?
• 26:12
  Francesco Cipollone: I think if you want to summarize it is ASPM is the future of software security, period.
• 26:19
  Francesco Cipollone: Like, you can't do software security if you don't understand how software is built together, who owns it, and what you're going to do with those problems, and where does that problem lives.
• 26:30
  Francesco Cipollone: Because otherwise, it's guesswork.
• 26:31
  Francesco Cipollone: It's like you hope that you're going to get to the vulnerability that is going to hurt you.
• 26:35
  Francesco Cipollone: But if you absolutely know that You kind of have an intelligence as usual.
• 26:40
  Francesco Cipollone: So ASPM enabled you to, depending on the version of it, my version of ASPM is helps the business understanding their posture of what they build and where they run and help expressing risk based decisions that can be understood by engineers.
• 26:57
  Francesco Cipollone: And those are actionable risk based decisions.
• 27:00
  Francesco Cipollone: So it's not just, I want to be secure.
• 27:02
  Francesco Cipollone: but what that mean in quantitative story point for all of the engineering community and saying, am I trying to be too secure or I'm trying to be less secure?
• 27:12
  Francesco Cipollone: So it's moving the needle of the whole organization forward.
• 27:16
  Francesco Cipollone: And it just started with application security because every organization is a software company around nowadays and a cloud company.
• 27:23
  Francesco Cipollone: So I think it's where the needle and the boundaries right now of innovation is being pushed.
• 27:30
  Chris Romeo: So I heard inventory was one big piece, so one of the problems then, if I wanted to just kind of summarize this, right, so one of the big problems that it's going to solve for us is it helps us to inventory assets.
• 27:42
  Chris Romeo: that we may not, uh, be able to currently trace ownership of assets, but we may, but it helps us to get that inventory because we're, we're sending our results from multiple tools and things towards the ASPM solution.
• 27:58
  Chris Romeo: And so it gives us that traceability and that inventory side, right?
• 28:02
  Chris Romeo: And then I guess one of the other things that I think about is it does help us to solve the, just the overall flood of information.
• 28:11
  Chris Romeo: Right?
• 28:11
  Chris Romeo: Because if we have a SAST tool, if we have an SCA tool, if we have other, other, other technology types that are feeding in, we could end up in a situation where I have a finding in a SAST tool, a finding in an SCA tool, a finding in some other tool that are actually the same problem.
• 28:30
  Chris Romeo: So we do get that correlation too, right?
• 28:32
  Chris Romeo: That we, that we, we talked about.
• 28:33
  Chris Romeo: So that's one of the
• 28:34
  Francesco Cipollone: And compounded one and the compounded one.
• 28:37
  Francesco Cipollone: So the single picture of things.
• 28:40
  Francesco Cipollone: So you can see.
• 28:41
  Francesco Cipollone: you can see an application and the riskiness of an application versus the volumetrics of a number of vulnerabilities that a single repository has.
• 28:50
  Francesco Cipollone: So you can evaluate product and the riskiness of a product where, I mean, Ivanti was the perfect case where you see a problem in a vulnerability in an operating system, but as a product, you have so much risk that you're carrying that if you look at the problem holistically, you will say, damn, I need to do something about it.
• 29:10
  Francesco Cipollone: But if you look at the problem atomically, They're kind of not that scary.
• 29:14
  Francesco Cipollone: So I think that's where ASPM could help a lot on painting a global picture of really what a product is.
• 29:25
  Francesco Cipollone: So ASPM is the future of product security.
• 29:34
  Robert Hurlbut: All right.
• 29:35
  Robert Hurlbut: Well, one other question we have is, I think it's one we've asked it before for different things, but how does or how will AI impact ASPM?
• 29:45
  Francesco Cipollone: Oh boy, that's a lot of questions.
• 29:48
  Francesco Cipollone: Um, I think AI can help.
• 29:52
  Francesco Cipollone: And yeah, I know that LLM can help in a lot of things in ASPM, but point in time solution, point in place solution, it can help kind of grouping things together by looking at patterns of who touch what and kind of grouping those things together and trying to figure out You know, this particular number of people have touched this particular number of files and can be grouped together into a concept of application because understanding the concept of application is really complicated and not a lot of organizations have thought it through, um, what is an application.
• 30:27
  Francesco Cipollone: So sometimes it's challenging and we're solving with AI.
• 30:30
  Francesco Cipollone: On that terms, or understanding and trying to correlate what kind of technology stack you have so that if you are victim of a specific vulnerabilities or problems across the board, you can kind of correlate to a specific technology stack, even if you don't have specific vulnerability that manifests in that.
• 30:51
  Francesco Cipollone: And generally speaking, trying to group things together and correlate things together.
• 30:55
  Francesco Cipollone: The experiment and the thing that I'm hoping that is going to be successful is also trying to chain things together and trying to see if Putting A, B, and C together is actually more risky than fixing one specific thing.
• 31:09
  Francesco Cipollone: So if you can chain a web vulnerability with a library vulnerability, uh, and an operating system vulnerability, and it gets you through the escalation, and lateral movement, or vertical movement where you are.
• 31:20
  Francesco Cipollone: Uh, and you can only do that if you really correlate these things.
• 31:25
  Francesco Cipollone: And I don't know if AI could help in that, but, or attack surface management could help in that.
• 31:32
  Francesco Cipollone: Uh, we're still experimenting with few things, but definitely is promising.
• 31:36
  Francesco Cipollone: And AI could be helpful in there.
• 31:42
  Chris Romeo: Yeah, I could see the kind of the pattern matching summarization capabilities of Gen AI being something that would help.
• 31:52
  Chris Romeo: Um, I think one of the, I think one of the, the, the challenges that's going to exist with ASPM, I'm seeing this challenge in other places in regards to AI, and I, I was, was working recently with an AI engineer.
• 32:06
  Chris Romeo: who's a, uh, Ph.
• 32:08
  Chris Romeo: D.
• 32:08
  Chris Romeo: student at a local university.
• 32:10
  Chris Romeo: And I took him through a particular scenario where there was an existing algorithm that was providing a, an output for me.
• 32:18
  Chris Romeo: And I was thinking, uh, wouldn't that be cool if Gen AI, if I could use Gen AI to somehow enhance this algorithm?
• 32:24
  Chris Romeo: And his answer was, uh, I'm an AI, AI engineer.
• 32:29
  Chris Romeo: It's not gonna, you're not, AI's not gonna get you a better result.
• 32:32
  Francesco Cipollone: No.
• 32:33
  Chris Romeo: And so I think that'll be one of the interesting challenges with ASPM is if you try to AI fify it, I think I just made up a word, probably not the first person to use it, but if you try to AI fify the an ASPM solution, is it actually better than.
• 32:48
  Chris Romeo: ASPM that just had a solid algorithm written by a human that is able to process the data in a certain way.
• 32:54
  Chris Romeo: So I think time will tell as far as whether that'll be whether that'll be a thing or not.
• 33:01
  Francesco Cipollone: I think AI in general, maybe not, or LLM in general, maybe not.
• 33:06
  Francesco Cipollone: A chatbot that helps you explain things or group things together or identify things together.
• 33:12
  Francesco Cipollone: Maybe call help instead of just generating the SLA.
• 33:16
  Francesco Cipollone: the queries that traditionally you do, uh, that can be probably maybe helpful, but a point in time solution that will help from an AI perspective kind of paint a better picture or accelerate what you're already doing, but at scale, like asking questions to an ASPM that has that concept or context.
• 33:37
  Francesco Cipollone: But you need to build that context before and AI could help in building that context by identifying pattern or by suggesting as well Pattern of resolution like you might not know that you have 15 things that have log4j and that could be a campaign That's what we called AI based campaign to actually identify for you the things where you could invest biggest bang for bucks because it's a consistent piece of work that enables you to focus on unit of work that's, um, are more consistent.
• 34:07
  Francesco Cipollone: So it's going beyond just fixing a problem, but actually how can I be more impactful as a security team and help my engineering team focus on one thing so they leave us the biggest bang for buck?
• 34:21
  Chris Romeo: All right, cool.
• 34:22
  Chris Romeo: Robert, why don't you take us into the lightning round here where we have just a quick, uh, Just a quick kind of, uh, set of questions to, uh, for you to answer off the cuff.
• 34:32
  Chris Romeo: Boo!
• 34:34
  Robert Hurlbut: Frank, we have three questions.
• 34:35
  Robert Hurlbut: One is more of a controversy, but what is your most controversial opinion on application security and why do you hold that view?
• 34:44
  Francesco Cipollone: Well, that application, application security is dead and product security is the only thing that matters now.
• 34:53
  Chris Romeo: Sorry, I couldn't resist.
• 34:55
  Robert Hurlbut: I think we knew that was coming.
• 34:59
  Chris Romeo: We already heard, we already heard how, why you hold that view.
• 35:04
  Robert Hurlbut: All right.
• 35:04
  Robert Hurlbut: Uh, our second question is, uh, what would it say if you could display a single message on a billboard at the RSA or Black Hat conference?
• 35:14
  Francesco Cipollone: Just do asset management, just do asset management, like go back to the basics, like, uh, we're trying to solve all of it, um, with more scanner, but honestly, just go back to the basic of like, uh, What's an application?
• 35:30
  Francesco Cipollone: How to correlate things together?
• 35:32
  Francesco Cipollone: Who owns what?
• 35:32
  Francesco Cipollone: Where?
• 35:33
  Francesco Cipollone: Asking those questions can get you so much further away Than just saying well, I'm gonna scan some other stuff and I'm gonna have some other problems and it's not cool It's not sexy, but just do the groundwork We've seen it done It gets you with a month, uh, miles further away from your mature in your maturity model.
• 35:58
  Robert Hurlbut: And the last question is, what's your top book recommendation and why do you find it valuable?
• 36:04
  Francesco Cipollone: Oh boy.
• 36:05
  Francesco Cipollone: Um, I would say the latest book from Ross Holiuk and about, um, if you haven't read it, as a first or second time founder, Uh, I wish I had that book because it covers how to build security company and all the pitfalls that a security company, uh, have and have been, uh, through.
• 36:28
  Francesco Cipollone: Um, and then I have several others on application security, but I think that if I need to choose one, Uh, it will be that one because it's the one that impressed me the most.
• 36:39
  Francesco Cipollone: Uh, and I wish I had that book when I started.
• 36:44
  Chris Romeo: Very cool.
• 36:45
  Chris Romeo: So, Frank, we always like to leave our audience with a key takeaway or a call to action.
• 36:50
  Chris Romeo: And so what would you like to leave our audience with?
• 36:56
  Francesco Cipollone: I think understand how your organization works and start thinking about application security, not just as a security and development problem, but as a business problem and how to bring the business in, because we're trying to, we're trying to solve a problem between security and development.
• 37:13
  Francesco Cipollone: And I think we've reached to the limit of things that we can solve alone and we shouldn't solve it alone.
• 37:18
  Francesco Cipollone: And the SEC have.
• 37:19
  Francesco Cipollone: given us the mandate that security shouldn't take in his hands risk, but the business should own the risk and security should paint that picture of risk and give them actionable next steps.
• 37:33
  Francesco Cipollone: So if I need to leave, everybody is start talking with your business more, but in the terms that they understand, not just saying you have critical vulnerability, but as you have a risk position on your most critical application, and this is how you can get it done.
• 37:48
  Chris Romeo: Yeah, that's really good advice.
• 37:49
  Chris Romeo: I love, I love you came back around and landed on our discussion about the business and the interactions with them.
• 37:55
  Chris Romeo: So Frank, thanks for, uh, being a part of the application security podcast.
• 38:00
  Chris Romeo: We wish you best of luck with Phoenix security and look forward to continuing our conversation into the future.
• 38:06
  Francesco Cipollone: Brilliant.
• 38:07
  Francesco Cipollone: Chris, Robert, thank you so much and everybody stay safe out there.
• 38:10
  Francesco Cipollone: Goodbye.