APPSEC CA 2017 INTERVIEW

### Overview Recorded during training day (Day 1) at AppSec California 2017 in Santa Monica, California, OWASP Los Angeles Chapter lead Richard Greenberg interviews David Rook from Riot Games. The brief interview covers David's motivation for traveling across the Atlantic to attend the conference as well as his perspectives on essential industry fundamentals, upcoming focus areas, and ways to effectively scale application security teams and programs.

### Key Topics - **Conference Highlights and Location:** David Rook explains that having lived in Ireland for 11 years, the beach and sunny Santa Monica venue provide a strong appeal. He notes returning for three consecutive years due to the unique beachfront location, the high caliber of industry speakers delivering talks, and his first-time attendance at an AppSec California training course. - **Industry Trends and Fundamentals:** Rather than making predictions about future trends or threats, Rook emphasizes that the AppSec industry must refocus on fundamental security challenges that every organization faces. - **Third-Party Code Security:** Rook highlights that organizations traditionally concentrate heavily on the custom code they write internally. However, in reality, internal code constitutes only a tiny fraction of what is actually shipped in a product, necessitating a much stronger focus on analyzing third-party libraries and dependencies. - **Security Automation:** The discussion underscores that application security still relies too heavily on manual human effort. Because humans do not scale effectively, expanding automation across development and security pipelines is critical for scaling AppSec. - **Developer Engagement and Security Champions:** On the cultural and organizational side, Rook advocates for understanding developers' needs and cultivating developers into security champions to further scale application security efforts.

### Technical Details While the interview does not delve into specific tooling implementations or CVEs due to its high-level nature, Rook points out two distinct technical and operational imperatives: - Evaluating and analyzing third-party dependencies and libraries, noting that custom software forms a very small fraction of actual shipping product software. - Transitioning manual security assessment workflows toward automation to address human scaling limitations.

### Takeaways - AppSec programs need to prioritize securing third-party libraries and components alongside first-party code. - Relying solely on manual human effort creates bottlenecks; broad automation is essential to keep up with development velocity. - Scaling security successfully requires understanding developer workflows and nurturing security champions within engineering teams.