welcome back everyone
we are about to jump into a chat with uh
mario about uh apsec on a budget
uh mario is a software developer turned
security engineer his passions are open
source security and privacy
he spent the last few years doing
security in the fintech space but
nowadays he's a senior security engineer
at canva and spends his days
there spends his days helping developers
creating better and more secure code
um murray is also going to take up most
of the block so any questions please
have them ready for hallway chats after
the talk
take away mario
good thanks
hello everyone welcome to my talk
on a budget
i would like to start with something
that's super super obvious right like
budget is important it's important for
any organization anything of any size
that's well known but i also make an
argument that's even more important for
application security teams
and that's the case because of the
constraints common constraints that any
application security have it doesn't
matter if it's a small organization or a
large organization they all have the
same set of constraints
let me talk a little bit about the
constraints
so there are three constraints that i
feel like are common amongst all
application security teams
the first one is operational work or bau
can be in your company that becomes a
constraint when there is a lot of bau
work and your team cannot concentrate on
doing more meaningful impactful change
in the company don't take me wrong bau
and operational work is super important
that's what makes the company going
that's make sure the process are being
followed and everything is going
smoothly we are talking about like
vulnerability triaging we talk about
design review we are talking about fine
tuning tools
so there are all things that we need to
do but they are
in the sense to keep the company working
not necessarily to improve to move the
needle
um to improve the secure posture of any
organization that becomes a big
constraint when you have a lower budget
maybe you don't have the right tools or
you don't have uh enough people that
operational work is pretty much all you
can do
during your day job that makes abstract
things like a bit more stressed and a
bit more overworked
they know any abstracting
knows their where their bodies are bored
right like they all know there are
vulnerabilities that need to be
addressed
bad design decisions they need to be
revisited that uh systems that are like
outdated they need to be patched they
all know that and then again that
becomes a big constraint in a low budget
environment if you are doing a lot of
operational work and you don't have time
to go back and fix those so keep like a
lot of stress on the application
security
because they cannot do the change they
wanted to do
and the final constraint is to have
malicious actors right and that's very
specific for security and you're not
going to find in any other department
because we are talking to people like uh
malicious actors are people who don't
play by any rules don't pay like any
frameworks if you have a market team for
example
the market team competes with
competitors of other companies so there
is like a framework there are some rules
they need to follow
when you talk about malicious actors
they don't play by anything
the only boundaries they have is their
own budget they also have a budget they
also are a business of some sort
if their budget is bigger than yours
that becomes a constraint they're gonna
be able to to do more damage than you
have
um so that's that's the train main
concerns right like and in my experience
that like is is very common like um
where i am now there's a lot of strong
uh secure investment in the company and
then i can see improvements year after
year
but having our other working on the
companies
that the budget's not quite there or is
very very low
and
that's the reality for the majority of
australian companies
so there was this survey from sofos uh
earlier this year talking about a lot of
metrics of application uh cyber security
and they asked a lot of leaders in the
in the business i talked talk about the
cybersecure budget
and determine knowledge they use is is
not where it's supposed to be
which i find quite funny because it's
not where it's supposed to be can be
anything from
zero to like oh it's actually a good
budget but you need a little bit more
but the reality that's it we don't have
much budget
we don't even we have lots of
constraints
so it's kind of a problematic situation
isn't it
but there is hope
there is hope although the best solution
for low budget is better budget there
are things you can do to make sure
everything's working smoothly and then
you can make meaningful change a little
bit of creativity strategy and kindness
can go a long way
so i'm gonna bring like six tips i have
used before in my career that hopefully
can help you as well
let me start
with things like call like zero budget
things
there are things that
you can do and don't spend any money
no money so anyone can do it
and the first one is what i call like
find allies
right
that's the number one thing you need to
do
we security always asking people to do
things for us we are always asking
people like uh to fix a vulnerability to
triage uh um a bug report so we're
always asking people to do stuff
sometimes we also need to ask to make
more meaningful changes structure
changes which people can be
a bit defensive about it because it
requires a lot of work
so i'll give an example when i was
working in a company
raped for canva i was working a company
where they
don't didn't have much secure budget
the secure budget at the time was my
salary i was the first ever security
engineer there was a really good
experience by the way to to be creative
with low budget
um and then
as you can imagine my first few weeks i
found a lot of vulnerabilities right
left and center lots of bad practices
everywhere
so i had to do some meaningful
structural changes in the way we did a
few things to make sure we improved the
needle of the secure posture
so the change that i wanted to do is
email verification
any secured person knows that if you
start the conversation about email
verification you know that's gonna be a
hard conversation it's not gonna get any
easy people have like they get defensive
quite quickly and there's a good reason
for it that's where the kindness needs
coming we need to understand where the
people are coming from
the reason being is that emails email
verification makes the sign up flow of
any application harder
and makes it make sure like users
there's a drop on the user side um of
user signing up there are solutions for
that there are ways to go around that
but was having a hard time to start this
conversation people didn't want even to
start this conversation they were trying
to focus on something else
so what i did instead i i went to like
to my buddy on the risk team right and
risking unnatural allies of any security
team because they are looking at risks
all across the company
some of them are going to be cyber
security risks and i was talking like to
this person and say hey
i'm having a hard time you know like i'm
trying to push for these people don't
start even the conversation he told me
like wow
i i also have this same problem we are
having this problem at this moment like
i'm just responding to this because we
don't have email verification we had to
send some information for a few users
and the emails were wrong and we sent to
different people where the emails were
valid so
people
got pii from them so this is not good
and it happens
already
and there was amazing information for me
because he provided me data that i
didn't have because from my side was a
concern but they didn't have any kind of
like a security breaches on on that side
but he knew what was happening on on his
side and then i could come back and make
a more compelling argument to the to the
engineering and say we need to do that
that is already happening problems the
risk
um
department is also aware of this and
they don't also want the fakes
so then we start to make the
conversation still was a hard
conversation but i managed to move like
they need a little bit like let's let's
start having this start discussing this
and there are other allies in other in
your organization that you can try to
find
um legal people are usually good allies
as well um infrastructure people they
are usually are secure aware and they
try to make everything is more secure so
find these people find how they can help
and try to collaborate with them you're
going to need them before trying to make
a meaningful change when you have a low
budget
the second one is super super important
cannot stress this enough do not waste a
securing incident
security incidents are big propellers
for change
the worse the incident the more change
you can try to make
but be in your best behavior during the
incident you're in the spotlight
everybody's looking what the security is
doing it
that's not the time to blame people
that's not the time to say i told you so
that's the time to make sure the problem
is fixed and then after the problem is
fixed you can try to use that to get
something for you
so for example
um when i joined this company at the
very early stages of the interview they
told me mario we are hiring a security
engineer but we are not thinking hire
anyone else for the next 12 18 months
i'm like okay all right yeah that's your
decision let's see
what i can do with that
three months in three months
uh i was having a conversation with a
colleague of mine like uh in the kitchen
and then we're just talking about like
uh some practices we have in the company
and she suddenly dropped a very bad
practice she just like said something
really bad and then i said oh
wait a minute do we do we do that here
she's like
possibly yeah
then okay
i came back my computer started to do
some investigation and
it was bad it was really bad
so i had to go that was before covet
right
uh owing the office so i went like tried
to find the head of engineering at the
time and he was
in a meeting room
having a meeting but i knew that
incident was urgent so i knock on the
door
open a little bit to say hey
i need a little bit of your time
he was like right now
i'm like yeah right now
he was visibly annoyed he left the room
he was annoyed and he's like well what
do you want so urgent talk about it
then i explained what i just discovered
and impact
his face went pale and he's like oh okay
thanks for letting me know
and they took a few weeks for me to
actually finish this incident from start
to end and again again operational work
right like
incident
response or just make sure the company
is working
and fixing like other smaller bugs but
that's considered operational work this
bau
after when this after incident was done
and closed i had to talk to him and say
look
that's the last three months that's
pretty much what i have been doing like
only operational work only incident
response
if you gonna start doing that like a
long term i'll not be able to make any
meaningful change i need an extra person
and i got a yes
right and i got a yes because he could
see there was like a a big problem the
problem was worse than he expected and
the security incident
that securing specifically went to high
levels like the ceo had to know about it
they went to the boards was was nasty
was very nasty
and that's really big propeller for
change so if you are
have low budget when there is a security
incident make the best you can from the
incident make sure your leaders know
what's happening make sure like you
finish the incident you close it off and
then you can make a big impact
and then you can use that to have a bit
more influence in your organization
so there are two tips that you can use
today like in your organization for zero
budget
i want to talk a little bit about tools
and techniques
tools for security is problematic
open source can go
a lot far
but it doesn't go to the very end
um let me talk about what i
want to
tell
so open source right
there are many tools in security they
have good open source tools i love open
source i contributed to open source
that's amazing
but
be careful with open source there are
the open source projects which are well
maintained
there is an active community
people are
actively developing
and there is open source projects to
somebody
did over the weekend
put in github and it's left unmaintained
by five years
make sure you choose the the project
that makes sense to organization brings
more solutions and problems
but um thesaurus can only go so far
there are lots of things that we need to
do as absec team members that open
source doesn't cover very well yet might
be in the future but not very well
yet so one of the things that i want to
do
for the company was introduce dependence
management
looking at vulnerable dependencies make
sure they are fixed make sure they are
working as expected
and i started with some open source tool
but that wasn't working fine like that
wasn't working the way i expected
so i tried to look um to other tooling
like to buy tooling
and they are bloody expensive
they are super expensive i knew if i
tried to get these numbers i went to my
leadership and say when you spend that
much money for this one single two
they'll say no for sure for sure they'll
say no
luckily at the time
there was a group of engineers trying to
make a business case to move the source
code to github
a github at the time it still has this
dependable right and the pentabot does
provide some of like the capabilities i
needed for dependence management
so rather than like trying to push for
other more expensive tools i managed to
go back and say look there is they are
doing this use case already i can add my
use case on top of it and make their
argument more compelling
and make sure the leadership can try to
get this tool
it wasn't the best tool for me but it
definitely went a lot further than i
wanted so that was really good
it's a bit hard though this one it's not
every time you can do that but if there
is opportunity to get other people uh
having
leveraged the tool you need that's also
make your argument more compelling it's
not only security asking for something
it's like security or engineering or
infrastructure or whatever else
i want to take talk a little bit about
um
scale influence
as any abstract team member knows there
is nothing
we can um there's there's nothing there
is
we cannot be involved in every single
thing that's not possible we cannot
review every single line of code we
cannot we ever design a dock we cannot
be like on top of every single thing
right that's
just not possible
so we need to first get some influence
and then we need to scale that
right
so i'll talk a little bit about how you
can try to do this
so the first thing is you can try
to give value first
that's like very basic human behavior
if you have somebody that's always
asking you for something
there's somebody that's always going
after you and asking like hey can you do
something for me i need this favor
you're not gonna like this person very
much and that's
that's human behavior that's you me and
everybody else you work with
so you need to provide value for then as
well and there are many ways to do it
but i'm going to share one way that
worked very well for me
is
i was
two weeks in on that company and
they were at the time they were
rebuilding the optic authentication
system
which was amazing it was really needed
they did like a really good job
all the way like from define
authentication is and which systems
we're going to use to the very bottom
how we're going to implement it that was
really nice
there was one part of the design dock
that i wanted a bit of change
but look we need to read the room
i was just two weeks in
first ever security engineer
they didn't know me i didn't know them
there was very little chance
that i could come up with something like
um and then influence them to actually
make the change that i needed right
everybody was still looking at me it's
like what's gonna happen now i have a
secure engineer
luckily it was my first two weeks so i
didn't have a lot of operational work
yet that was the first two weeks where i
was
doing
knowing about the company talking to
people so there was not much on that
side
so what i did instead i implemented
myself
now with help of course the infrared
thing
at the time was doing some really nice
developer tooling that was doing some
really good uh
tools on that space and i said like can
i
try to do a poc can i like figure out
something i want to implement this kind
of feature
and they were super helpful they helped
me develop this i created the pr
and i did the poc dev stage broad it
worked right
and i managed to implement what the
things that i want to request
so that and that um that alone showed
them
a lot of things so then like if uh i
can't get my hands dirty right like if i
need i'm not just a secure engineer
that like uh doesn't know anything about
appsec or software engineering you know
i i know how to code i know how to do it
i also show them if like i need to get
my heads dirty to help them i'm gonna do
it like i'm more than happy to do it and
that improved the design and they didn't
request much from them so that was a way
to get like an influence
to my knowledge these changes still in
production to this day of course people
involved evolve it and change it
but the basic
structure is still that which is really
nice
um so that's one way to give to give
value first and get some influence
i'm pretty sure everybody can come up
other ways like other ways that i have
seen
is like doing a good treadmilling
session is a really good way to get like
influence and people say like oh there's
actual session was actually really
really good so
um i want to learn more about that that
sort of stuff so but the main concept
here is give your value first sometimes
do yourself do the thing make sure your
change pushes to all the way to
production and make sure everything is
well aligned
the second part of it
is how to scale your influence right and
then you need to have influence to scale
influence so the first part is a little
bit how to get some of these influence
but there was a time at the company
where people were like getting to know
me i was able to make some changes i i
was able like to to get some things done
i
i was lucky enough to get somebody else
to help me uh working on that too but
that was not enough right two people is
not enough so how do i scale that how do
i make sure
the security the right secure things is
still happening even not in the room
uh or if i'm like there is
a difficult decision to make they're
gonna make the right call right
and i'm calling here secure friend
friends you can call security champions
it doesn't matter the name
but the important thing is you need to
find and then again a little bit about
find the lies you need to find people in
your organization
they want to learn about security and
they are there they might not be
super passionate enough
to just like make a move and in like a
go to a full-time position security but
they want to learn about more about
security they are interested in the
subject they find like that's
challenging exciting and they want to
learn more about it it's amazing and we
need to leverage this right
the way i did it
was um
i come up with like this group like the
secure champions i open to
everyone and say look if you want to
learn more about security
if you want to have fun doing some
security activities
come come aboard we're going to do some
cool stuff
uh and yeah at the beginning i got four
or five people which was like amazing i
was concerned that nobody would actually
sign up so i got four it was good
um
and then i come up like with some cool
exercises like for example i deploy a
vulnerable lambda and then i ask then to
go and hack and everybody who could hack
it you i'll pay some coffee
i paid lots of coffee so that's not very
low budget but it was really effective
to get like um
to get people uh
interesting insecurity and try something
simple something like challenging and
something that make them think right
like because when they hack it something
they start to think about it
so did i boot something that's also
vulnerable to this there's a really
effective way to get them to start to
think about security
i started like lock picking competitions
as well
i got like i had a few locks at home
like yeah cliche secure engineer sorry i
do have them
but
i brought them to the office uh i get
them to do a little bit of lock picking
and try to understand like um how
hacking is not that different right
you're trying like to put some input and
see what's gonna happen which kind of
error you get which kind of outputs you
have to to open the lock
um i got like some free training
resources as well so they could go and
learn about more security and what
happened was amazing because like every
monthly meeting they were coming back
with nice
and they were starting to discuss secure
challenges that they have their own
teams and they started like oh look we
are trying to design this feature
and this is not working very well
um so how do i how do i do this and the
people start to talk about it i didn't
even need to say anything
do it was like talking helping each
other and come up with resources if
there's anything that was like um they
need my support they're going back to me
and say mario like look can you help
look at this i think this code's a bit
like um uh
vulnerable can you have a look
and
for me it was really nice as well
because i could go back to them and say
like look i want to talk a little bit
about security of your team i know who
they should approach right is the person
that's already like
focused about securities all right
thinking about security and to be honest
the level of the person doesn't matter
that much right
even if they are like more junior or
mid-level
they still know enough that they can
provide you some value give you some
hints and insights right so that was
useful for me as well to go back to the
teams and talk to them
uh i also went like the the time company
was not not too big and we had a
company-wide demos and i always talk
about it like look
that's the cool stuff you're doing
you're losing you're missing you're not
going you're not going there
and i managed to get like after a few
months from four five to nine ten which
was amazing right like there's a lot of
people actually interested in
anyone like um learn more about security
uh another good way to scale influence
for people who are not part like are not
that passionate about security to
actually jump to these sessions
is i was i used to
tell them about the security since we
had
right and then it was a really nice way
to show like look
again no blame i didn't talk about
people in about anything i just talked
about like this happening
and there was a bad situation
and then we managed to fix it but we
took like that amount of resources i got
i had to get to the engineers for a few
days i spent two weeks on this on this
so we need to be make sure that it
doesn't happen again
and that's useful there's like uh people
they might not be very passionate about
security but they surely don't want to
give like more trouble so that's another
way to scale
influence and
just to finishing off
there are
what i want to talk about it's the very
last thing is the most important thing
as well
if you are liking a low budget
setting you'll probably be like
overstressed and overworked
so do not despair it can be a very
stressful situation i know i was there
but you need to understand that small
victories they compound
right like a victory you have today can
get a little bit more influence to do a
bit a bit bigger changer
than the week after and so on so far
they compound
so when i was when i joined that company
i was the first security engineer and
lots of vulnerabilities lots of things
to fix
and people didn't know me i was having a
hard time influence people 12 months
later
a lot of the critical fixes well were
there like they happened
um they
were invited me for like a security lead
security engineering leads meeting talk
about priorities
uh for the next quarter or so even
though i wasn't a team lead
people easy even using to call me like
head of security and always reply to
them and say if i was ahead of security
i would have a budget
um but anyway i
it's possible to make change you need to
be patient
please do not despair and you take care
of yourself
burnout is the thing and if you're in a
low budget setting it can be really
really difficult so take your time like
um budget is not something we control
very much just exact team members is a
leadership decision
so you you can't do what you can do with
the resources you have so just be
patient take care of yourself
do not spare
yeah that's why i had to talk today
thank you very much you're hiring by the
way
i'm not listening um
chris
hey
first person to be on camera and muted
well done me i was typing your
two-minute remaining thing out just as
you finished
um thank you very much it was great uh i
imagine there are going to be some
questions based on the chat so uh please
have a chat in um
in the hallway track
we are breaking for lunch now so we will
see you all again at half past one uh
australian eastern time
have a great break everyone
thanks