---
title: "Irfaan Santoe -- The Power of Strategy in AppSec"
url: https://appsecpodcast.com/irfaan-santoe-the-power-of-strategy-in-appsec/
date: 2024-07-31
duration_seconds: 2414
season: 11
episode: 20
guests: ["Irfaan Santoe"]
topics: ["Building an AppSec Program", "Privacy and Compliance"]
audio: https://www.buzzsprout.com/1730684/episodes/15506236-irfaan-santoe-the-power-of-strategy-in-appsec.mp3
video: https://www.youtube.com/watch?v=6joDiRchwQA
transcript: true
---

# Irfaan Santoe -- The Power of Strategy in AppSec

*July 31, 2024 · 40 min · Season 11, episode 20*

with [Irfaan Santoe](https://appsecpodcast.com/guests/irfaan-santoe/)

on [Building an AppSec Program](https://appsecpodcast.com/topics/appsec-programs/), [Privacy and Compliance](https://appsecpodcast.com/topics/privacy-and-compliance/)

[Audio](https://www.buzzsprout.com/1730684/episodes/15506236-irfaan-santoe-the-power-of-strategy-in-appsec.mp3) · [Video](https://www.youtube.com/watch?v=6joDiRchwQA)

## Show notes

Irfaan Santoe joins us for an in-depth discussion on the power of strategy in Application Security. We delve into measuring AppSec maturity, return on investment, and communicating technical needs to business leaders. Irfaan shares his unique journey from consulting to becoming an AppSec professional, and addresses the gaps between CISOs and AppSec knowledge. Irfaan shares valuable insights for scaling AppSec programs and aligning them with business objectives. Irfaan Santoe joins us to discuss the power of strategy in AppSec. We go deep on this one, on AppSec program maturity, how we can measure maturity, and even some tips for success. We talk about measuring return on investment and how to speak the language of the business as a technical person.

The Application Security Podcast is brought to you by [Security Journey](https://www.securityjourney.com/).

About Security Journey  
We provide diverse training content and easy-to-digest lessons to meet individual learner needs.  
→ [Learn more about Security Journey](https://www.securityjourney.com/)

Connect with Irfaan Santoe:  
→ [OWASP SAMM](https://owasp.org/www-project-samm/)  
→ [OWASP Security Champions Guide](https://securitychampions.owasp.org/)

Mentioned in this episode:  
→ [OWASP SAMM](https://owasp.org/www-project-samm/)  
→ [OWASP Security Champions Guide](https://securitychampions.owasp.org/)  
→ [BSIMM](https://www.blackduck.com/services/security-program/bsimm-maturity-model.html)  
→ [Jim Routh on Twitter](https://twitter.com/jmrouth1)  
→ [OWASP Netherlands Chapter](https://owasp.org/www-chapter-netherlands/)  
→ [OWASP SAMM](https://owaspsamm.org/)

Chapters:  
00:00 Meet Irfaan Santoe: The Power of Strategy in AppSec  
03:12 That's kind of the— it's almost the opposite of what a  
06:35 A little bit about maturity. So, what is maturity within an  
09:30 We think about measuring maturity then, so let me read back  
12:20 Yeah. So, what is a part of that link then  
17:16 Okay. So, we talked a little bit about, you know, how  
20:59 I think there's a real disconnect between the business side and  
27:03 Because that seems like, I mean, that's return on investment to  
29:39 I've been waiting to ask this next question for a long  
31:49 Yeah. And, if we use your car example and if I  
33:51 Let's pull all this together. How do we scale an AppSec  
38:12 All right. So, we have 3 questions that we usually ask

## Transcript

*6,647 words · assemblyai*

**0:00 Chris Romeo:** Irfaan Santoe joins us to discuss the power of strategy in AppSec. We go deep on this one, on AppSec program maturity, how we can measure maturity, and even some tips for success. We talk about measuring return on investment and how to speak the language of the business as a technical person.

**0:21 Irfaan Santoe:** The Application Security Podcast is brought to you by Security Journey. We provide diverse training content and easy-to-digest lessons to meet individual learner needs. Learners report improving their knowledge as much as 85% on AppSec topics. Learn more at securityjourney.com.

**0:37 Chris Romeo:** Hey folks, welcome to another episode of the Application Security Podcast. This is Chris Romeo. I'm the CEO of Devichi, also a general partner at Curve Ventures, and co-host of the Application Security Podcast, joined as always by my partner in crime, Robert Hurlbut. Hey, Robert.

**1:06 Robert Hurlbut:** Hey, Chris. Yeah, Robert Hurlbut. I'm a principal application security architect and threat modeling lead at Acquia. And as you mentioned, always glad to be here with you as well.

**1:15 Chris Romeo:** Today, we're going to go in a direction that we don't spend enough time talking about. We always focus in on the bits and bytes of AppSec programs and tools and new technologies and the things that are fun to go to conferences and hear about and look at shiny demos and whatnot. We don't spend enough time talking about maturity and return on investment. And so we have Irfaan Santoe with us who has a lot of experience and a lot of knowledge to share with us and wisdom to share with us about these topics. But Irfaan, first, security origin story. How did you get into this world of security?

**1:57 Irfaan Santoe:** Yeah, thank you so much, Chris, and a pleasure, really true pleasure that I could be part of this podcast. My origin story on how I rolled into information security, application security, you could call it kind of dull, but it does have an angle to it, which I think it's It's not common. It's unique. I would even call it like that. I am a security programmer, software engineer, but I got rolled into the security world as a consultant after graduation. And it was not after 7, 8 years of being a security executive, a security consultant, that I got in touch with the application security part of it because I was asked to lead an application security program for one of the largest banks here in the Netherlands. And some way, somehow, I got sucked into the love that there is, the passion that there is for application security. And I've not been able to get out of that since then in such a way that I'm not even thinking about letting go of my CISO career to become more of an AppSec application security professional consultant for the industry. So, it's CISO turning AppSec professional. That's how I would call my story, Chris.

**3:11 Chris Romeo:** So, that's kind of the— it's almost the opposite of what a lot of people see as their career trajectory. They see the CISO chair as the pinnacle of the top of their career. And now you're saying you've kind of gone the opposite direction. You've gone from— you made your way up to the CISO chair and now you're going into the technical side of AppSec. So, what's drawn you to leave the CISO chair and to take on this AppSec role?

**3:41 Irfaan Santoe:** Yeah, thank you. That's a great question, Chris. So, what I've found, Chris, is that most of the CISOs, they either have a GRC background or infrastructure background. That's how we have grown to become CISOs, right? Some of them even have an internal audit background. It's just only a few CISOs out there that have an application security background or software engineering background. I think that's quite rare to find those CISOs with an AppSec background. And I am really appreciating the fact that we have more like a shift-left, developer-centric focus nowadays, more than ever on AppSec. But what's happening with that trend, Chris?

**4:26 Robert Hurlbut:** Yeah.

**4:26 Irfaan Santoe:** great trend. It's exactly how it should be. But because of the CISO and the CISO department not having a strong background in application security, what I'm seeing is that they're being left behind on the topic of AppSec more than ever because the shift is happening more and more towards the CTO and the developers. So, what has inspired me is to really help the CISOs close those gaps of AppSec understanding AppSec, how to drive AppSec programs from a CISO's perspective, and try to close that gap for them by being that, I would say, chink between the CISO and the application security/engineering professionals. That's my purpose and ambition for the next 5 to 10 years.

**5:13 Robert Hurlbut:** Yeah.

**5:14 Chris Romeo:** And I think that's a noble pursuit, definitely. And I think about one of the CISOs that I've learned the most from in the last, I'd say, 10 years is a guy named Jim Routh, who ran software security programs at— I think he built 5 to date. He's retired now. But when I think about product security, AppSec, CISOs, Jim Routh is the name that comes to my mind as far as somebody who really understood the software security side And that was the core of what he did. He certainly understood the other pieces of being a CISO, the GRC, the audit, the other angles, the infrastructure, things like that. But when he working for companies that were trying to perform digital transformation and were going from perhaps being an offline company to an online company, him using software security at the core was really brilliant. on his part to be able to kind of make that type of a lead. And so, we've interviewed him a number of times on the podcast too. He's one of these guys that I could listen to for hours just because he's got so much wisdom in building these programs.

**6:30 Irfaan Santoe:** I've noted the name, Chris. Thank you for sharing that.

**6:32 Chris Romeo:** Yeah.

**6:34 Robert Hurlbut:** So, let's talk a little bit about maturity. So, what is maturity within an AppSec program?

**6:41 Irfaan Santoe:** Yeah, that's a great question, Robert. So I think that's, I'm gonna give you the answer from a CISO's perspective, right? Because that's why I'm here. You guys must have heard many of the sort of takes and answers from a developer's perspective, a CTO perspective. I'm here to really talk on behalf of CTO, sorry, CISO/CIO perspective. So I think maturity is really about growth. And one thing that it's important to the CISO, CFO, CIO is that we can actually that the risk level of an organization is on an acceptable level or it's getting lower, it's getting better. I think that's the perspective I want to bring if we are talking about measuring application security maturity. So, can we see that the security risk is getting to an acceptable level? And can we see that it's going down as well? That's the question we need to be answering ourselves To be able to answer the question, are we mature and what is the maturity we have? So I would like to reason from there. And of course, I'm not— I've not shared this, Chris, but I'm also the OWASP chapter leader in the Netherlands. I'm a project leader on Security Champions Guide as well. So I'm very closely related to OWASP. Unfortunately, I could not be in Lisbon now. Like you guys probably are not traveling over there for the Global AppSec Program conference, but So if you look at what OWASP has developed as guidance, right, for how to approach application security for organizations, they have more than 20 to 25 different projects, right, with different elements of how to address application security. When you go to, to a CIO or a CFO and talk about, you know, we need to do these sort of investments more on specific areas of application security, the first question is ask, why is it that we're asking this and what is the return on investment that we're getting? Like, show me the problem because that shows me that I have to invest money. And if I invest money, I get an investment on that. Sorry, a return on that. And what is that return? Is that the risk level either needs to go down to an accepted level or it needs, you know, we need to stay within what we call the risk appetite of the organization. So I don't have a clear-cut answer what AppSec maturity is, but I would like to bring into the equation of the conversation that it's about getting the risk level to an accepted level within the organization and then tie it back. And that really depends per organization because the risk appetite per organization is different depending on their business, depending on, you know, also the appetite that they have ultimately to manage risk. That will be definitely different for a bank versus probably a manufacturing company.

**9:30 Chris Romeo:** So, when we think about measuring maturity then, so let me read back some of the things that I just heard. Maturity is about complying or being at an acceptable level of risk. Like, a mature organization has met those goals of delivering a program that is within the boundaries of the acceptable levels of risk that the CFO, CIO, maybe even CEO, maybe even the board of directors are putting forth as far as where the organization needs to be. So then, when we think about maturity from that perspective, does that mean maturity is a GRC function then? Because GRC is really who's tracking the results of how we're managing risk and then is able to tell us if we're within the acceptable levels? And if that's the case, how does AppSec play in with GRC?

**10:39 Irfaan Santoe:** Yeah. So, that's exactly the link that I'm trying to make in this conversation, Chris. So, it's not that AppSec fits into GRC, but GRC is there to answer this question, right? If I want to comply, if I want to keep my risk at a specific level within the organization, what controls, what programs do I have to implement to make that happen? And in order to be able to do that, you need to also understand where your risks are, but also what the control improvements are, programs are that you have to implement. So I want to even advocate that it's not only application security, it's any other information security domain, whether it's network security, endpoint security, you have to also look at from that angle. That doesn't mean that we're going to strive for compliance. No, I'm in that sense really a security guy. But we need to be able to answer that question. What is that return on investment? And that cannot be answered without understanding what is it that we're trying to achieve. And ultimately, it doesn't matter which organization you have, whether you look at from a CISO perspective or even from a CTO perspective. We want to get the risk controlled on a level that we all accept. So that's why I'm making that tie back to risk and control. And maybe, you know, your question that you've asked, Chris, comes from the fact that, you know, as security professionals, we sometimes have bad experience with GRC, right? Because we feel that they don't understand us and we don't understand them. But it is there. We cannot neglect it. We cannot ignore it. So it's better for us to find a way to work with it. And I'm trying to make that link between AppSec and GRC.

**12:19 Chris Romeo:** Yeah. So, what is a part of that link then? Like, do GRC people need to become AppSec knowledgeable, or do AppSec people need to become GRC knowledgeable, or what's the answer? Like, how do we— because it seems like with GRC, often in my experience, The organizations I've been a part of, I would say GRC had very little visibility into what was happening from an application security perspective or even a product security perspective. GRC was focused on classic risk management, right? Like, what are all the physical things that could happen to our factories? What are the, you know, those were the risks, the types of risks. And if we would've said, hey, here's the output of a threat model, they would have been like, this has nothing to do with us. So, like, what's the answer here? Do GRC people need to learn AppSec? Do AppSec people need to learn GRC? How do we solve this?

**13:21 Irfaan Santoe:** Yeah, that's a great question, Chris. And I think it needs to happen on both fronts. It is GRC folks need to learn more and more about information security, and that's AppSec. But it's also that we need to better speak that language of GRC Business as AppSec professionals ourselves, ultimately, Chris. Now, how do you make this a little bit more operational? I think for— let's start with the AppSec professionals, right? And let me state out there, Chris, this is the Application Security Podcast, right? So, we know how scarce the resources are when we talk about application security professionals or even CISOs. ISSCs have struggled many times to really find application security professionals helping me as a CISO, not from a GRC function, really from IT security perspective. So, it's already a challenge to have the AppSec professionals. But even though if we have them, let's assume we have them, Chris, it would be good to also start asking the question, okay, I have this as an application security lifecycle, Secure SDLC, for example, that you want to implement. Think about the different controls that we can implement.

**14:28 Robert Hurlbut:** Yeah.

**14:28 Irfaan Santoe:** You know, we have threat modeling as one of the key capabilities that now is being looked at as one of the standards within secure software development, Chris. But we have also different sorts of technologies. Think about SaaS, DaaS, IaaS, WAF, you just name it, all these different capabilities. Now, the first question that we need to be able to answer as security professionals, AppSec professionals, to our leaders within the organization, but why do I need to introduce one more control on application security. And if I'm going to do that, it's going to cost the organization X amount of dollars. Like, how do I justify that? So, that conversation needs to be happening more and more from the application security perspective towards the leadership. That's one. And secondly, I do also feel that for GRC professionals, it has been a challenge for them because they are focusing on all the different risks. It's not only information security. It's information security, it's IT risk, it's operational risk, it's physical risk. You just name it, they are there. They're looking at those components, but they will also have to skill themselves up more and more on the information security risk because it is becoming a strategic risk, right? Like boards are now really worried about cybersecurity, information security risk. It's probably in the top 5 risks that they're managing. So they have to skill up. Now, there's always already a leap that they have to— a gap that they have to close from operational SGRC towards information security. And within that, it's even more difficult because application security is really already a niche within information security and a complex one, I would say. So I would say start having those conversations, try to understand, try to understand what are the different controls we're looking at and why are we suggesting to start implementing, for example, SAST as one of the capabilities if you have AppSec maturity program that starts from zero, right? Like, what are the drivers of suggesting, and I would even say advising as a GRC leader, that you need to start with these capabilities from an AppSec perspective? Or you can even turn it around. You can start asking the right questions. But why have you selected threat modeling as the capability to be implemented within your AppSec program, looking at where you are and where you want to go? Like, asking just the questions without you having to give that answer. But let the AppSec professionals give you that answer. It's about having that conversation, Chris, because I don't know the answer, to be very honest. If I would know the answer properly, the industry would be looking a little bit different because then we would be having these sort of conversations with the answers. But I think it's about finding the answers now. There is a lot that is being advocated about implementing application security, and I think we need to start better and better justifying why we find that specific controls need to be implemented.

**17:15 Robert Hurlbut:** Okay. So, we talked a little bit about, you know, how do you know that you have a mature program and so forth already, but how would you recommend or what do you recommend for practitioners to progress to a more mature program, and do you have any particular tips or steps to success?

**17:38 Irfaan Santoe:** Yeah, yeah, that's— so the way I would do it is, Robert, and I've done that for for a couple of organizations myself. I'm very curious to hear other folks talk about this and share their ideas with me as well. But like any other program that you would approach, you would try to understand where are you at, right? A maturity program is all about growth. You want to increase the maturity of where you are at in order to be able for you to say, I want to grow, you need to understand where you are at. So it's so important to understand that baseline or to understand through an assessment, whether it's an automated assessment, a questionnaire using OWASP, PCI, it doesn't matter what— whatever framework you're using specifically for application security, really try to understand where are you at and then set the right objective, the right target with your management. And my advice is don't do that only as an application security professional. Try to establish that target state together with your CISO, together with maybe even your CIO. Try to set the target state where you want to be at in terms of KPIs, in terms of metrics, right? Where should the risk level be? Should I be very efficient with preventing risk being introduced? Should I be very effective with solving risks once they are introduced? So think about The whole notion of shift left, right? The reason why is we're saying one of the reasons is it's more cost-efficient if you're going to shift left because you're finding issues earlier in this stage of software lifecycle development, and fixing them is cheaper because probably you don't have to rewrite a lot of code that you've already written. So, I would start with setting the baseline. Where are you at? Really defining very clearly where you want to be at and what are the drivers? Why do you want to be there from a target state? And then, you know, build that roadmap around it. around it. Now, and that roadmap, mostly what you will see, Chris and Robert, when you look at maturity assessment programs like OWASP SAM or PCI BISM, it's a little bit descriptive and prescriptive, telling you these are the things you can do, but it never tells you why. And it doesn't give a good justification in terms of the dollars spent versus the actual output that you're getting out of them. I think that's where the work is for us, because then once we have that nailed down, once we are able to use that information and have a dialogue with the CFO because budgets are coming from the CFOs, from the CTOs, from the CIOs, you have a much better chance of succeeding selling your AppSec program.

**20:19 Chris Romeo:** So, I guess this brings us to what I like to think of as the million-dollar question, the million-euro question, the million-whatever-your-local-currency-is question. And that's the idea of return on investment. So this is a concept that's very foreign in the technical world, return on investment. Well, no, the return on investment argument is, of course, we need to do that because that's the best technology that we need to make available for what— that's gonna make us the most secure.

**20:57 Robert Hurlbut:** Yeah.

**20:59 Chris Romeo:** But I think there's a real disconnect between the business side and the technical side when it comes to return on investment. So let's start unpacking this. And I'd love to, by the end of this little segment, give folks some ideas about how to understand return on investment, but also how to embrace it if you're an AppSec professional. So starting out, let's just put a definition on the table. Irfaan, as a CISO, who who's been in the conversations at the executive levels, give us some perspective about the CFO, the CIO, the CEO, the CMO, the other people around the table and the board. How are they processing return on investment?

**21:41 Irfaan Santoe:** Yeah. So, it's very simple. For them, that's all what they do, Chris. They manage baseline risk, right? So, that means a baseline. Of things that they have to comply to. There is no discussion about return on investment because they have to comply to that. That's a separate discussion. But doing enterprises, running enterprises, it's all about taking risks, right? Whether it's strategic risk that you're taking with your customers, it's product risks that you're taking a specific direction or you're slowing down product engineering or product development. because you want to invest more into sales. All those discussions, they bring risk to the table. So, for board members, managing boards, having that risk conversation, it's not foreign. It's their bread and butter. They are very good at this one and they're very smart at doing this thing. But for making a link between the technical risk of IT, and it's not only security, it's just IT in general, towards what that ultimately means from a business perspective. Some way, somehow, we have been struggling with this to make that transition. Now, what, what is happening now, we're trying to be smart as CISOs most of the time by talking security to the boards, right? Showing them that we know where the risks are, but we're not able to make that link. What, what does it mean to address that risk and what are the choices that impact if we're going to pick you know, that $1 from the budget that we have and spend it on cybersecurity and even within cybersecurity, different domains, if you have to choose to, how is that going to impact if I'm going to spend that $1 on something else or not on something else that still is needed to achieve the strategic objective of that organization? So if you are able to present as a CISO, I would say your budget discussion, your ask towards the managing board towards if we're going to spend this money on these programs from cybersecurity perspective, this is how it's going to pay us off on a later term. I think that would be a good way to start that conversation with and also putting in perspective of the different, I would say, business and IT initiatives that are happening. I've seen CISOs being extremely successful, Chris, if they're able to link their cybersecurity programs in that sense. When we're talking about application security, their application security programs back towards IT change programs that have already been approved or business changes that have already been approved and being pushed forward within the organization. So, for example, if we're moving towards the cloud, and that's what I found as well with the book that I wrote last year, if organizations are moving towards the cloud, there's mostly a business case behind that, why organizations are wanting to move towards the cloud, whatever that business case is, right? I've heard people saying it's going to be cost efficient. You know, that is one thing that I don't strongly believe in, that's the case. But still, people are using those business cases. But one of the strongest business cases, use cases that are being called out of moving towards the cloud is it makes us more agile, right, as an organization, because, you know, we can scale very fast up and down and we can move along with the technical developments that, you know, these cloud providers give us. Now, That IT business case, use case is already presented. Now, what does that actually mean from a security perspective? How does your security challenge, your security operating model change because of the fact you're moving towards a cloud organization? Now, if you can frame your risks that you're seeing, your application security, your information security risk accordingly towards that IT change that's happening, that's going to make you more successful as an AppSec professional, as a CISO. But the same you can do for business initiatives. So if we're seeing that the business is now thinking about addressing a new market for their products that they have, what risks are there and how does that translate ultimately to an IT risk? Right. If what role does IT have to play to enable that, that business objective, that decision that the business has taken? Now, what is the position of security within that? And one step deeper, one level deeper, how does AppSec fit within that question? Those are the questions you have to start thinking as a CISO, as an AppSec leader, if you want to be more successful convincing the leadership of putting those dollars into your AppSec program. And I'm not even talking about, okay, if I put $10 into AppSec, this is how it's going to return me. That equation we have not yet solved, Chris. But I'm pretty sure that we will solve that in the next 5 years because cyber risk quantification is one thing that's happening. It's controversial, but it is happening. And sooner or later, you know, we will also solve that problem within the AppSec space.

**26:32 Chris Romeo:** So then how do you assign a dollar value to purchase something? And how do you equate that to some type of risk cancellation?

**26:50 Robert Hurlbut:** Yeah.

**26:50 Chris Romeo:** Then if there's not a formula, because like, I'm thinking about it and I'm like, It seems like if you could show me a 2-to-1 return on anything, I'm going to move forward with it.

**27:03 Irfaan Santoe:** Yes.

**27:03 Chris Romeo:** Because that seems like, I mean, that's return on investment to me. I'm giving you a dollar, you're giving me $2 worth of value. But it doesn't sound— it sounds like you're saying it's not that simple. So then how do you— how does it play out in the real world today then?

**27:15 Irfaan Santoe:** Yeah. So that's one take, right? Risk is to really maximize your return on investment. And that's really, If I put $2 in it, I get $10 back. That's definitely a business angle of looking at it. You can also look at, okay, I only have $2 to spend that. Where do I spend that to minimize the risks the best for information security? And application security is a component in that. So, that's the question you always have to be ready for that can be asked by the managing board towards you as a CISO.

**27:49 Chris Romeo:** Yeah.

**27:50 Irfaan Santoe:** Now, we can even look at ourselves, right? So, if we say, because risk is information security risk, we want to prevent we're getting hacked. But another risk would be, okay, we want to make sure we are executing the information security program as efficient as possible. What does that mean? If I am implementing a control, Chris, that reduces the risk to medium, but it costs me $100 million to actually build that control and run that control, maybe another control that costs me $10 million to build and run, but reduces that risk to medium-high is a better control. And we have to look at that from that mindset also within application security. So think about all the different controls we are able to implement for application security, Chris, having a WAF in place, doing threat modeling, SAST, DAST, setting up trainings for developers. All these different things cost money to, one, set it up, and secondly, to run it. Now, if I have to choose for getting the risk level on application security to a specific acceptable level, which of these ones would I put in which order to implement? Yeah.

**29:11 Chris Romeo:** Hmm.

**29:11 Irfaan Santoe:** And again, I don't have the answer, but it's about asking those questions and having that dialogue and coming to some sort of data, some sort of equation where we all feel comfortable with and say, okay, it makes sense what is on paper now. I am not seeing that sort of conversation happening nowadays on a CISO level, on a CIO level, on a CEO level, on even an information security program level. Chris, especially for applications.

**29:38 Chris Romeo:** So, I've been waiting to ask this next question for a long time, and I finally found somebody that I think can answer it for me. Okay, so here we go. Why doesn't security and privacy have an unlimited budget? Given the fact that we know that if we invest in security and privacy, we could reduce risk to zero, why don't we have an unlimited budget then?

**30:03 Irfaan Santoe:** Great question, Chris. As a security professional, I really love to have unlimited budget for privacy, managing privacy and security risks. But the nature of running enterprises is to take risks. If we're not gonna take risks, there is no rewards. It's as simple as that. And if you want to make a link towards something that's closer to you as a professional, as a person, We always have a chance to get hit by another user of the road or a driver if we are walking on the street. Does that mean we're not going to walk on the street? We are accepting an inherent risk for us to, when we cross over the street, that we might get hit by a car. Of course, we're trying to minimize that, but that doesn't mean that we're going to stop going outside of our home, right? That's a decision one can take, but that means you're killing your business. Taking a very conscious decision, I will not do business in this area, I will not do business by using IT. It's a very conscious decision, very unlikely decision that will happen. So I don't think it's the right way to really look at it as CISOs to ask for an unlimited budget for security and privacy. One, it will make you very inefficient as a CISO. Secondly, it's so counterintuitive towards what businesses are about, it's about taking risks. The key thing over here is you have to take risk within what we call the risk appetite. That means how much risk are you willing to take, and then manage the risk towards staying in that quadrant, in that space of risk appetite. I think that's the key thing over here. And so therefore, unlimited budgets, although it sounds very beautiful and nice, I think it's very counterintuitive. intuitive the way we run enterprises.

**31:48 Chris Romeo:** Yeah. And, if we use your car example and if I meld these 2 together and draw a conclusion from it, I don't drive a tank as a protective measure. I don't invest in a tank that I drive around on my city streets to ensure that if somebody runs into me, they just bounce off because My car costs $20,000. The tank would cost $2 million or $5 million. I could technically buy the tank and drive the tank around and it would eliminate, but it still wouldn't eliminate my risk. I would still have risk. It would eliminate the risk that you were talking about, but I couldn't create a world where there's no risk. I could drive off a cliff. The tank isn't protected against driving because I can't see out of the tank because it's so hard. It's got a little hole that I, not a windshield, right? So I get what you're saying though.

**32:43 Irfaan Santoe:** There's like, it's, To make the link, because I've shared that I'm from Amsterdam, I live in Amsterdam. So Amsterdam is a city of bicycles. I really, really love cycling. So what we have seen over here as well is there's a lot of theft happening on cycles because it's the city of cycles. So one can say, I'm gonna spend $500 buying a cycle, and then you'll have a keychain or a slot that you'll buy. A lock that you'll buy for €50. Now you can even decide to buy locks in total of €1,000 to secure your bike. But is that even worth it then, what you are trying to protect? So that's also the mindset we'll need to have. I mean, I saw these beautiful pictures where you'll have one bicycle securing with 50 locks, really literally 50 locks in the streets of Amsterdam. That's not where we want to be at because then it becomes unmanageable to the business to do IT, and then you're killing it. And that's not the purpose of information security. It is to ultimately enable the business and be there for your customers and the expectations they have about you.

**33:50 Robert Hurlbut:** So, let's pull all this together. How do we scale an AppSec program from the CISO's perspective? We talked a lot about maturity. We talked about unlimited budgets and things like that, but pulling it all together, how are we scaling and meeting the needs, and especially from a perspective of CISO?

**34:23 Irfaan Santoe:** Yeah, that's a— I mean, we can approach this very methodologically, right, Robert? We're saying, okay, Look at your baseline, where you are at, your target state where you want to be at, define the different steps to get there, and then execute that. That's a way of scaling your AppSec program because it will bring you to a target state. Now, if we go one level deeper, I think for CISOs, where AppSec professionals can help CISOs and CISOs can help sell the story towards CIOs and CFOs ultimately, as well of scaling AppSec is to really look at a control and the cost of that control. So take for example threat modeling, right? So if we want to scale threat modeling, we can say let's first prove that threat modeling delivers value. It reduces the risk to a level that we want, right? At least it helps to reduce the risk to a level that we want. But executing threat modeling manually You know, costs a lot of development time. It costs a lot of security folks. You have to upskill. So you have to look at the total cost of control to do threat modeling. And that's only for one application, but probably you'll have 500 applications you want to do that if you're a medium-sized to large organization. Now scaling that, that becomes a question of what is there out— what is there— what is out there that you can use to make the cost of control go lower and also minimize the risk of that control failure of happening or that program failure, preventing that program failure of happening because you're implementing trap modeling as a program. So if your skilled people that know how to trap model, they leave the organization, it's a risk, right? So if those risks occur, probably the scaling will not happen of your trap modeling program. So I think before introducing any new control on an enterprise level for your organization, really take a step back and really say, is this something that's going to scale? And which sort of areas of risk are there for me as a CISO, as a leader, to really see that there is a risk of this scaling if these things occur? So maybe you need to set up the control differently. So then you might go towards the direction of saying, Okay, now I have the option to automate threat modeling as much as possible. That means our developers do not have to be yet that much skilled, but they can already start consuming the basic threats that come out from any platform that will suggest, or I can start pushing training to these developers, right? For them to know what security is about. So it puts you in a different mindset, Robert, to think about where you're gonna do the investments at. Mostly from the question, That's not a one-off thing that you have to do. You have to do it for the coming 3 to 5 to 10 years. And that burden of what you're introducing within the organization of control overhead is immense. So be extremely careful of what you're introducing as a CISO because you're gonna burden the organization with good or bad. So for me, scaling is also that dimension, Robert. It's not only going from your target state— sorry, your baseline state towards your target state and executing your roadmap, but really critically looking at which controls you really want to implement and don't create more security technical debt because somebody has said, let's create and implement that control. You have to really think through it. Every control we're introducing as CISO within an organization, unfortunately, it reduces the risk. Fortunately, it reduces the risk, but it puts a lot of overhead within the organization. And we have to be extremely mindful about that.

**38:04 Robert Hurlbut:** All right.

**38:07 Chris Romeo:** With that, it's now time for Robert's lightning round.

**38:12 Robert Hurlbut:** All right. So, we have 3 questions that we usually ask, or 3 areas, really. So, first one is, what's your most controversial opinion on application security, and why do you hold this view?

**38:28 Irfaan Santoe:** Yeah, to be very honest, it's not my view of what is controversial, but I do feel that those are things that resonate with me, is the whole idea of DAST versus IAST versus RASP. Like, for me, I think it's quite controversial within the AppSec domain. And what holds for me, I think none of the things have really been proven yet what works. The moment we are able to quantify implementing a specific control, specific technology, and showing that that results into lowering the risk, whatever that risk is, right? It could be cost, it could be security risk as well. Maybe we'll have a better discussion and we can conclude on that, Robert.

**39:13 Chris Romeo:** Okay. Excellent. Well, Irfaan, thank you for sharing your wisdom and your knowledge gained as a CISO. As you've, you've had that foundation of AppSec and it's been great just to explore things like return on investment, the business side. Like I said at the top of the show, things that we just don't focus on enough as technical security people. We tend to push that off and say, that's, that's Irfaan's problem, the CISO. He needs to solve these problems for me. I don't need to think about business value and return on investment, but the most successful professionals are going to be those who understand these concepts and can play and can swim in this pool. of business and return on investment and risk and quantification and all these types of things. So, thank you once again for sharing your insight, and we look forward to having a further conversation with you at some time in the future to dive into some other facet of AppSec. So, thank you.

---

Source: https://appsecpodcast.com/irfaan-santoe-the-power-of-strategy-in-appsec/