Application security manager: How AI changed the game
Last Updated on May 22, 2024
Application Security Management in the AI Era
The average cost of a data breach in 2024 has spiked to $6.5 million per incident, a 150% increase on 2020.
Astonishingly, around 50% of these attacks are estimated to have been either AI generated or developed.
85% of cybersecurity professionals attribute the increase to the use of AI by bad actors. This sudden rise in AI enabled cyber attacks is also in stark contrast with the long documented cybersecurity skills shortage, putting ever more pressure on cybersecurity management.
This extreme pace of change has transformed the role of application security managers, who are ultimately responsible for the holistic security of an application.
In modern IT, that application will typically be a SaaS or a custom software solution, all hosted on cloud.
And in terms of application security, this is likely to be coming under growing AI-generated attacks such as smart automated vulnerability scans with highly contextual input injections, using GenAI for advanced personal phishing attacks and generating customized trojans.
The role of application security manager has been impacted by these meta-trends, growing strategic and complex as the variety, scale, and sophistication of cyber attacks have grown exponentially.
We are living in a world where anyone can buy live 2FA-protected session tokens for internet banking users of large banks for less than $10 on the dark web. AI is clearly playing an increasing and accelerating role here.
AI can be used by bad agents, for example to generate deep fake fraud or to create customized malware at scale, or by good agents, such as those using AI-powered tools for account monitoring and fraud prevention.
AI as a field, is also fast evolving, so we thought we would take a moment to recap for our application security manager colleagues, what the role entails in modern terms:
Role of a modern Application Security Manager
Generally speaking, modern application security manager job descriptions entail the following remits, expectations, skills, and outcomes:
Lead the development and implementation of comprehensive network protection, and network-led monitoring projects and programs (e.g. to counter DDoS and man-in-the-middle attacks)
Lead the development of user account fraud protection projects and tooling,e.g. to counter typically new account opening fraud, phishing attacks, session hijacking, data theft, identity theft, etc.
Conduct regular security assessments and audits to identify vulnerabilities in applications and software (or plugin) updates. This is because regular posture and cybersecurity updates allow organizations to keep up with ever-changing threats.
Collaborate with development teams to integrate security practices and awareness, as early as possible in the design stages of software development life cycle. A best practice here is running threat modeling sessions with the team even before starting the implementation.
Incident response, mitigation and post-analysis: Operationally, application security managers are expected to respond to incidents as immediately as possible, some critical incidents requiring 24/7 responsibility. This includes alerting authorities, implementing immediate mitigation, and conducting post-mortem analysis.
Implementing preventive measures: Related to the point above, modern application security managers are also expected to continuously optimize their cybersecurity posture to prevent future incidents.
This remit is closely related to cybersecurity data management. Data collected enables forward-thinking, preventive decision-making that can positively influence a wider coherent digital strategy (product, SEO, architecture, etc.)
Ensure compliance with regulatory requirements: At minimum reach relevant cybersecurity standards, develop and enforce security policies, roles, governance, processes and procedures.
Research new technology & innovation: To know to a reasonable degree, the latest security trends, threats, and technologies to continuously enhance security framework.
Team management, mentoring, contingency planning: Future proofing cybersecurity, mentoring promising colleagues, building shared understanding, and planning contingency/succession. Foster a culture of security awareness.
Oversee the application security lifecycle, implementing security policies, and conducting security audits at the right point in time, e.g. before a major release or after a critical change.
Cyberpolicy, digital strategy advisory and strategy: Advise other departments because cybersecurity typically affects a variety of other corporate strategies such as your UX and product development, especially for SaaS companies. A hot topic is how modern AI-powered security can help in improving user experience instead of undermining it.
Budget & Resources planning: You may also be expected to have sound budget management skills, and basic TCO assessment of your cybersecurity stack, both in terms of Opex and Capex, as well as Upfront/Recurrent costs profile.
What skills do modern application security managers have?
With cybersecurity attacks expected to cost around $9.5Trn globally in 2024, it is no wonder that organizations have tried to attract cybersecurity managers by raising their remuneration.
Application security engineers are already the 3rd highest paid class of cybersecurity jobs, oscillating between $150k to $200k per annum. Manager promotions to the same role can add another $50k-75k.
This rise in remuneration is reflected by the rise in expectations, from the average cybersecurity manager. Organizations pay more for cybersecurity professionals, and demand more out of them, faced with a growing threat on a weakening job market.
The strategy works to a point, the US for example suffering from a record 3.5 Million cybersecurity jobs vacant in 2019 already.
These are the most valuable skills and qualifications typically expected of the ideal application security manager:
Bachelor's or Master’s degree in Computer Science, Cybersecurity, or related. However, cybersecurity has moved so fast recently that we see an ongoing weakening of this traditional criterion, in favor of hands-on experience.
Minimum of 5 years of experience in application security or a related cybersecurity role. This one may depend on the profile, some engineers with only 2-3 years in a specific type of cyber/fraud tech may well find work inside larger ICT/cyber teams.
Strong understanding of security policies, cryptography, authentication, authorization, security vulnerabilities, and remediation techniques. No one is expected to be an expert on every aspect of every fraud type, but sound fundamentals are required across the board.
Experience with security frameworks (e.g., OWASP Top 10, CWE/SANS Top 25, NIST SSDF) and security standards (e.g., ISO/IEC 27001, SOC2).
Proficient in using security software tools and vulnerability scanners.
Excellent leadership skills with the ability to manage and motivate a team.
Strong problem-solving skills and the ability to work under pressure.
Excellent verbal and written communication skills. Increasingly a critical requirement as the role includes more mentoring, involvement in design, strategy, and corporate wide programs.
Ability to build a scalable, fit for purpose holistic cybersecurity strategy and policy, that counters and/or mitigates all relevant types of cybersecurity threats.
Ability to surface cybersecurity data and trends, to keep ahead of the general cybersecurity race. Seeing different types of fraud modeled as metrics for your cybersecurity monitoring is useful to make better strategic decisions.
Experience with automated security tools from network monitoring to AI-led behavioral biometrics detection of fraudulent account usage. Scaling cybersecurity has quickly become a must-have skill for most cybersecurity roles, belying the critical role of adaptability and scaling cyber defenses to a growing, changing threat.
Ability to provide a holistic view of entire cybersecurity posture and strategy, across all threat types and tools, preferably in an integrated software such as security platform wazuh.com (which can also be called an application security manager)
Ability to customize cybersecurity policies to support UX: A benefit of AI-led security tools such as behavioral biometrics fraud detection is its non-disruptive, continuous monitoring in the background, which is not triggered if the user profile shows normal behavior with no signs of fraud.
Integration of security at the development phase: Whenever a new software product or feature is being built, best practice is for application security managers to get increasingly involved (consulted) during design stages. This often involves performing threat modeling exercises to highlight potential threats and mitigations available to the team.
Preferred Skills:
Certifications such as CISSP, CISM, or GIAC are highly desirable.
Experience in programming languages, such as Java, Python, TypeScript, or C#.
Prior experience with cloud security and technologies (AWS, Azure, Google Cloud).
Prior experience with cross-functional teams and programs (with design, software, architecture and product teams chiefly)
Growing cyber risk, growing mandate
Application security managers always faced a variety of challenges, but the recent advances in AI and cybercrime have added substantially to their mandate.
A 2020 report by IBM Watson estimated that cyber data breaches cost an $3.68Mill each, by organization and incident. This number rose to $4.35Mill ($165 per record on average) by 2023, across all industries.
They also found that data risk is higher in regulated environments, targeted more, at higher financial cost, risk and damage than average.
In the medical industry for example, the average cost of a data breach has now risen to USD$11Million.
With cybercrime becoming a potentially catastrophic risk to organizations, more strategic resources are vested in cybersecurity, and more is expected of cybersecurity managers.
The days of “simple” technical network monitoring as a cybersecurity strategy are fast receding. Modern cybersecurity must consider a growing list of threats, of dizzying variety and sophistication.
Pentesting and typical network based cybersecurity protection policies will always remain best practice, but they must urgently be complemented by other types of cyber protection.
Spread of malware has created an environment where user account fraud and data-theft related fraud, often powered by credential stuffing and session hijacking, are fast growing and need a solution fit for purpose.
AI and modern application security management
AI is already being used by bad agents to accelerate user account fraud, such as account takeovers and creating fake accounts for exploitation, but AI can also be leveraged to monitor app usage and protect applications.
Application security managers facing a growing list of threat classes, mutating rapidly, will gradually need to be able to leverage AI solutions for scalability, to stay ahead of the curve.
Cybersecurity is often described as a typical “Red Queen race” where balance between attack and protection is constantly weaving back and forth. Similar to evolutionary biology that follows red queen race scenarios (prey vs predator) and warfare (ballistics vs armor).
For example, there are bug bounty programs that incentivize external experts to find and report software vulnerabilities. These programs help identify and fix security issues before they can be exploited by bad actors, enhancing overall system robustness.
For application security managers, implementing a bug bounty program is critical these days because it extends the security review beyond the internal team, tapping into a global pool of talent, which speeds up the discovery and resolution of vulnerabilities.
This trend towards a smarter, more adaptive and automated cybersecurity class of defenses is visible in the typical job descriptions of application security managers nowadays.
Gone are the days when the key requirement was to be able to set up a 2FA identification policy and do limited training across the organization.
In, are the days where application security managers are responsible for cybersecurity as a strategic weapon, a vital business risk mitigation, a source of key data, a new way to engage users whilst protecting them.
AI Cybersecurity as strategic tool for organizations
Modern organizations leveraging cybersecurity as strategy now increasingly ask for a strategic, holistic, adaptive posture.
They also tend to word their job requirements more in terms of business needs and strategies than technical experience only.
Application security managers are still mostly expected to have some hands-on technical knowledge and ability to perform, but they also now must provide strategic clarity, communication, collaboration and direction.
Often, AI-led cybersecurity is also a substantial source of help in modern cybersecurity, not only a new class of threats.
In key strategic aspects, solutions such as AI-led behavioral biometrics account protection offers scalability, predictive ability and low UX impact.
AI technology “at heart” can support directly multiple key requirements of the modern application security manager:
Scaling defenses easily / in real time: Extreme ease of configuration for a nuanced cyber posture. Scaling and customizing cybersecurity, for say, a specific use case or an extremely high profile project.
Providing a holistic view of the cybersecurity program, threats, protection and tools, events and trends. AI can analyze very large amounts of data, easily visualized in open source cybersecurity platforms such as wazuh.com
AI allows for immediate response, risk and cost mitigation: AI-led cybersecurity can often prevent fraud before it happens, compared to reactive cybersecurity tools. If a cyberattacker buys a fraudulent token on the dark web, hijacks a user session and tries for a fraudulent transaction, he will quickly leave a trail of usage signals (IP, device, keystroke speed, etc.) clashing with the profile of the account owner. AI behavioral biometrics can mitigate immediately, depending on configuration, to freeze an account before the fraudulent path/transaction can be completed, slashing financial risk (platform and user).
AI allows for much finer trend analysis, leading to “predictive” cybersecurity program management, helping organizations control their cybersecurity and staying ahead of the curve in the longer run.
Conclusion: AI cybersecurity scaling and application protection
Soon enough, adaptive, holistic and scalable, early-intervention cybersecurity postures will be the only viable option for a variety of businesses, chiefly those handling high value data.
The role of application security manager is tilting ever so increasingly towards business strategy, scaling and adaptability of cybersecurity policies, posture and configuration.
AI-powered cybersecurity allows for an extraordinary monitoring of the threat portfolio, in real life, for the longer run, and generally at no UX costs to good users/agents. Network monitoring is still a best practice, but often identifies vulnerabilities once damage has been done.
With the growing financial and strategic exposure of application security managers, AI cybersecurity policies are fast becoming a must have, that will both increase employment odds, as well as their ability to best meet their role.
More articles
Combat fake registrations and focus on success
We are here to help you for discovering strategies to safeguard your business from unwanted fake registrations after promotions and campaigns to forget about fraud and scale your business securely.
CrossClassify
25 King St, Bowen Hills, Brisbane QLD 4006, Australia
