Building Application Security & Engineering Partnership in Parallel

Ever wondered how AI could revolutionize software security? In this digital era, the fusion of AI and coding might just be the key to a more secure software landscape. Dive into this episode of the Seeding Appsec podcast as we sit down with software security maven, Mark Stanislav, and unpack the future of generative artificial intelligence in software engineering. We delve deep into the buzz surrounding tools like GitHub Copilot and its potential in reshaping how developers code. Amid the awe and criticisms, Mark paints a picture of a future where AI doesn't just assist but also safeguards against security flaws. As the lines between technology and security blur, he underlines the essence of prompt engineering and its monumental role in the age of intricate tech stacks. But what does this mean for the budding security professionals? Mark shares invaluable advice, advocating for passion in technology as the foundation for a robust security career.

What we cover on the episode: [00:00 - 23:14] Collaborative Approaches and Tailored Interventions • Application security is evolving towards a holistic approach, emphasizing early education, shifting left, and partnership with engineers. • Security interventions should be tailored to different stages of the software development lifecycle, with high value and low false positives. • Effective collaboration means understanding engineers' tools, workflows, and preferences, to integrate security seamlessly. [23:14 - 44:33] Shaping Secure Collaboration • Enhancing security involves integrating various signals like developer security, software composition analysis, and more into a singular actionable platform. • Collaboration between security and product teams is vital for delivering value, enhancing trust, and ensuring security is seen as revenue-generating rather than a cost center. • Generative AI tools, like GitHub Copilot, could evolve to assist developers in writing secure code by suggesting secure coding patterns and providing security-related explanations. [43:34 - 47:57] Lightning Round! • If you were the leader of an anonymous hacker group, what would it be called? Mark would name the anonymous hacker group "null bite" because it's obfuscated and malicious. • How do you take your coffee? Mark takes his coffee hot with Splenda and occasionally almond milk. • What advice would you give a young aspiring security professional? Mark advises aspiring security professionals to focus on a passion for technology first and build that as a foundation. • Michigan or Michigan State? Michigan. Go blue! Connect with Mark! LinkedIn: https://www.linkedin.com/in/mstanislav/ Check out his website at: https://www.uncompiled.com/#/ We hope you enjoyed this edition of Seeding AppSec! Check out the latest trends in application security discussed with our esteemed guests from around the globe. Don't miss any future episodes; subscribe to Seeding AppSec on Spotify, YouTube, Google Podcasts, or Apple Podcasts. This podcast is proudly brought to you by Arnica, a revolutionary application security solution reshaping how AppSec teams tackle risk identification and mitigation. Explore Arnica.io for detailed information about their cutting-edge security solution, featuring real-time pipelineless risk identification and git posture management. Protect your developers, code, and products without compromising development velocity. Stay connected and informed by following Arnica.io on LinkedIn and Twitter for the latest updates and insights on application security. Thank you for joining us on this enlightening journey into the world of Application Security! Remember to prioritize security and continue seeding AppSec in your organizations. Until next time, stay secure and keep innovating! Key Quote “Don't be too excited to be a security hacker person. Go be excited about all the capabilities and creativity that comes from engineering. And then figure out how security is applicable.” – Mark Stanislav