Beyond the Bug Hunt: Unlocking Your AppSec Superpowers

Beyond just finding flaws, bug bounty programs are a gateway to stronger AppSec by utilizing global collaboration and community. Successful programs require organizations to define a clear scope, offer appropriate incentives to researchers, and prioritize responsible disclosure over legal threats. This collaborative approach helps uncover critical bugs internal teams miss, fostering a security culture that ultimately helps launch cybersecurity careers.

1. Beyond the Bug Hunt: Unlocking
Your AppSec Superpowers
Steven Carlson

Senior Product Security Engineer

2. About me
Software Engineer who is passionate
about clean secure code.
Helpdesk -> Software Engineer ->
Security -> DevSecOps -> Senior
Product Security Engineer

https://about.me/rockrunner

3. Agenda
Vulnerability Management
Lessons Learned
Leveling Up
Q&A

4. Keep Security Top of Mind
Forethought vs Afterthought

5. Vulnerability Management

6. CIA
Confidentiality, Integrity, and Availability
•Confidentiality: This involves
ensuring that data remains secret
and private.
•Integrity: Integrity ensures that data
remains accurate and unaltered.
•Availability: Availability ensures that
information and systems
are accessible when needed.

7. Vulnerability
Security Finding?
•A vulnerability is essentially a
weakness in a system, application,
or network that can be exploited by
malicious actors to gain
unauthorized access, steal sensitive
data, disrupt operations, or cause
other harm. It can exist in various
forms.

8. Triage Process
Security Review
•Identify the finding: This involves
understanding the nature of the security
finding.
•Assess the severity: Evaluate the potential
impact of the finding on the organization's
assets, data, and reputation.
•Determine the likelihood: Analyze the
likelihood of an attacker successfully
exploiting the vulnerability.
•Make a decision: Based on the severity and
likelihood of exploitation, security engineers
decide on the appropriate course of action.

9. Risk Matrix
Likelihood x Impact
•Impact is typically measured on a
scale of High, Moderate, and
Low, considering factors like
financial loss, reputational
damage, safety hazards, etc.
•Likelihood can be based on
historical data, industry trends,
expert opinions, or a combination
of these.

10. Mitigating Risk
Preventing risk from becoming a vulnerability
•Identification - what/where/when/
why/how ??
•Disclosure - informing the correct
person(s)
•Patch Management - mitigating
the risk that was found
•Verification - validating the “fix”
was completed successfully

11. OWASP Top 10
2025: late summer/early fall 2025
•Standard Awareness Document
•Focus on Critical Risks
•Actionable Guidance
•Data-Driven and Community-
Supported

12. Code Scanning
Snyk
•Open Source known issues
•Coding practices with security risk
•Passwords/Keys/tokens
•Known framework issues

13. Server-side request forgery (SSRF)
https://learn.snyk.io/lesson/ssrf-server-side-request-forgery/

14. Automation
https://docs.snyk.io/integrate-with-snyk/snyk-ci-cd-integrations/github-actions-for-snyk-setup-and-checking-for-
vulnerabilities/snyk-maven-action

15. Lessons Learned

16. K.I.S.S.
Keep It Simple, Stupid
•People
•Process
•Technology
•Governance

17. Shared Partnership
Not just knighting someone
•Create a clear picture
•Share ownership of the product’s
security score
•Establish a threat intel feed
•Recommend policy and standard
modification

18. Context is Key
Build the case with Product team(s)
•Training and Education
•Build Relationships
•Regular Feedback Loops

19. Shift Left and Extend Right
Oldie but a goodie
•Embedding a security engineer within a
product team
•Accept work that is achievable and
generally understood
•Establish a position within leadership and
engineering

20. Proof is in the Pudding
Find out the truth before spending money
•Should we partner with this vendor?
•Should we use this vendor’s software?
•How often should we require 3rd party
PEN tests?
•How will this software effect our
network?

21. Leveling Up

22. Implementation Framework
Monitor progress
Phase 5
Prioritize based on
risk
Phase 4
Manage coverage
Phase 3
Add business
context
Phase 2
Discover your
software assets,
from code to cloud
Phase 1

23. Application Asset Discovery
Implementation Framework
•Asset discovery across development
pipeline, from build time to runtime
•Integration with developer portals
and service catalogs (e.g.
Backstage)
•Map relationships between
application components
•Establish continuous updates for
asset inventory

24. Asset Classification
Implementation Framework
•Document business criticality of
applications
•Sensitive data types
•Ownership & responsibility
•Lifecycle stage
•Regulatory compliance requirements
•Classify your assets, automate as
much as possible

25. Risk-based Coverage
Implementation Framework
•Define risk tiers & security
requirements:
•Security tools
•Scan frequency
•Create automated policies
•Implement coverage validation
•Monitor coverage effectiveness

26. Risk-based Governance
Implementation Framework
•Implement contextual security
guardrails
•Establish remediation SLAs by risk
level
•Leverage visibility to drive risk-
based prioritization

27. Monitor Progress & Posture
Implementation Framework
•Risk-reduction effectiveness
•Dev-Sec collaboration
•Operational efficiency
•Business alignment

28. Security is a Journey
Not a destination

29. Q&A

30. Resources

31. Manual
Linux Command: man man
•Build security, as more than bolt it on.
•Rely on empowered product teams, more than security specialists.
•Implement features securely, more than security features.
•Rely on continuously learning, more than end-of-phase gates.
•Adopt a few key practices deeply and universally, more than a comprehensive
set poorly and sporadically.
•Build on culture change, more than policy enforcement.

32. Resources
Books, Website, and more
Books & Publications
•Application Security Program Handbook
by Derek Fisher
•Designing Secure Software by Loren
Kohnfelder
•Clean Code by Robert Martin
•Software Transparency by Chris Hugh
and Tony Turner
•Threats by Adam Shostack
Online
•SecurityChampionSuccessGuide.org
•attack.mitre.org
•nist.gov/itl/csd/secure-systems-and-
applications
•hockeyinjune.medium.com/product-
security-14127b5838ba
•santikris2003.medium.com/product-
security-dev-sec-tips-2fdb1698a3b3
•https://media.defense.gov/2023/Jun/
28/2003249466/-1/-1/0/
CSI_DEFENDING_CI_CD_ENVIRONMENTS.
PDF
•https://cheatsheetseries.owasp.org/

33. About me
Software Engineer who is passionate
about clean secure code.
Helpdesk -> Software Engineer ->
Security -> DevSecOps -> Senior
Product Security Engineer

https://about.me/rockrunner