Role of application security posture management in cybersecurity
Feb 2, 2024
auto_awesome
Idan Plotnik, Co-Founder of Apiiro, with 24 years of cybersecurity experience, discusses the challenges of managing vast quantities of repositories and misconceptions about Application Security Posture Management. He highlights the relevance of ASPM in both large and small organizations. The podcast explores the differences between Cloud Security and Application Security Tools, and the growing need for Application Security Tools. It concludes with insights into managing cybersecurity, mean time to remediation, and importance of customer feedback.
ASPM provides complete visibility into code bases, software supply chains, and application architecture, allowing organizations to prioritize alerts and make informed decisions about their risk posture.
ASPM plays a vital role in risk management for modern cloud-based applications by scanning code bases and identifying risks early, helping organizations understand and address risks at all stages of the development lifecycle.
Deep dives
ASPM and the Complexity of Modern Applications
ASPM, or Application Security Posture Management, is becoming increasingly important in the world of modern applications. With the rise of multiple languages, CI/CD pipelines, and complex architectures, it is crucial to have a comprehensive understanding of the risk management for applications at scale. ASPM provides complete visibility into code bases, software supply chains, and application architecture. It allows organizations to prioritize alerts and make informed decisions about their risk posture. The need for ASPM is growing, with 40% of organizations expected to invest in it by 2026.
The Role of ASPM in Risk Management
ASPM plays a vital role in risk management for modern cloud-based applications. By scanning code bases and identifying risks early in the development process, organizations can reduce potential risks before deployment. ASPM helps identify APIs, open source dependencies, secrets, microservices, and more, providing a comprehensive view of the application's architecture. It also enables the prioritization of security testing tools and processes based on an organization's governance and risk appetite. ASPM goes beyond traditional approaches by helping organizations understand and address risks at all stages of the development lifecycle.
ASPM and Cloud Security
ASPM complements cloud security solutions by focusing on the application architecture and risk management. While cloud security posture management (CSPM) assesses and secures cloud environments, ASPM is designed to assess the risks associated with application development. ASPM identifies APIs, open source dependencies, secrets, microservices, and other code components that could impact the overall security posture. By connecting these findings with runtime security solutions, organizations can achieve a holistic view of their application security and reduce the mean time to remediation (MTTR).
Regulatory Requirements and ASPM
ASPM is not only a best practice but is also supported by regulatory requirements. Standards such as PCI, CIS, NIST, and Salsa explicitly mention the need for assessing the security posture of applications and software supply chains. ASPM helps organizations meet these requirements by providing complete visibility, risk analysis, and governance support. With the increasing focus on secure software development frameworks and the accountability of CEOs and COOs for software security, ASPM is becoming an essential tool in the modern application landscape.
Navigating modern application security in a world of Cloud, DevSecOps and now AI is getting rather complex. We spoke to Idan Plotnik, who has 24 years of cybersecurity experience under his belt and is the Co-Founder of Apiiro about world of Application Security Posture Management (ASPM) and their relevance in both large and small organizations. Idan speaks about the challenges faced in managing vast quantities of repositories and tackles common misconceptions about ASPM, confirming that it's not intended to replace existing security pipelines.
Questions asked:
(00:00) Introduction
(04:58) A bit about Idan Plotnik
(05:56) Application Security tools explained
(08:09) Why Application Security Orchestration Correlation (ASOC) didn't work?
(09:14) Difference between Cloud Security and Application Security Tools
(14:51) Why is there a growing need for Application Security Tools today?
(19:07) Do Small to Medium size businesses need Application Security Tools?
(21:46) Managing Cybersecurity Tools
(26:08) API Security for Applications
(30:29) Dealing with Regulatory Requirements in Cybersecurity
(34:16) Evolving Goals in Application Security
(35:49) Deciphering MTTR in Cybersecurity
(37:54) The Fun Questions
(39:37) Where you can connect with Idan?
Get the Snipd podcast app
Unlock the knowledge in podcasts with the podcast player of the future.
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode
Save any moment
Hear something you like? Tap your headphones to save it with AI-generated key takeaways
Share & Export
Send highlights to Twitter, WhatsApp or export them to Notion, Readwise & more
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode