Open Source ASPM and Security Automation with DefectDojo’s Greg Anderson

This is Textron tv. Hey guys, thanks for the throw. We're here with Greg Anderson, who CEO for Defect Dojo, and they're fresh off raising an additional $7 million in funding for an open source application security, posture management platform, otherwise known as A SPM.

And of course, I think they also have a pro edition that's just come out as well. Greg, welcome to share. Thank you so much for having me, Mike.

Great to be here. In your mind, what exactly is an application security, posture management platform, and where does it fit somewhere between, I mean, we have DevSecOps and we have application security. Where does this kind of fit in the spectrum of things?

That, that's a great question. Um, there, there are a ton of buzzwords circulating around insecurity. When I think about A SPM, the two key pieces for me, or one visibility into what's going on within your automation processes and security, and then also, um, the consolidation pieces.

Those are the two things that I think are, are really key about, um, the solutions in this space and the, the vertical overall. And as far as I can tell you might be the only, uh, open source one of these, maybe the relatives I'm just not aware of. But why is it important to have an open source, A SPM approach, Uh, to, to my knowledge?

Yes, that's correct. So we, uh, started open source, Mike. We are a community driven platform, and so, uh, when we first created Defect Dojo, we sort of had a gathering of the security community, if you will, in terms of sharing our problems and figuring out how best we could solve them.

And so, um, it was really an organic movement that started quite a while ago. One of the things that seems to be driving everybody crazy is that the security people will discover vulnerabilities and then they'll toss that over the wall to the development community who will then spend some time determining that A, the issue at hand, the application is not internet facing, or b, it's not actually running in memory somewhere. And after a while they stop listening to the cybersecurity people until invariably something really bad happens.

Um, is there, is there a disconnect in the system that these A SPM platforms are fundamentally meant to solve? It? It's definitely a key piece of the equation for having any sort of successful security program.

It's, it's very true that, um, oftentimes security people, they don't have time to look at the results. That's really, I think, one of the greatest challenges in the space is that if you wanna scale a security program without ESPM, you're in a situation where you have to invest in headcount. And businesses don't like doing that because, um, to get those clear and concise results, you'd have to have a human doing it.

And so that's one of the things that the platform is, is really key to solve. Um, we are essentially doing an auto triage when data comes in to get you the cleanest results possible. And when an engineer goes in and applies different settings to a finding, we observe that input.

That's where the machine learning comes in. And so anytime a human makes an action in the platform, we apply that to all the results going forward to, um, get the cleanest and most, uh, concise results possible. Because that's, uh, one of the most key pieces in getting developers to actually fix things.

And when does that result arrive? 'cause a lot of times I'll talk to developers and they'll just shake their head and say, um, rather than being told there's an issue when they're writing code, they're told about it days, weeks, sometimes even months later, and they don't remember the context of what it was they were working at at the time. And then they gotta circle back to go figure that out.

And they just waste cycles doing that. So how real time can we get to the point where we're surfacing the insights required? So we have the, the flexibility to meet people wherever they are in terms of their security automation journey.

So the earlier you automate, the more feedback you can get. And so, um, we have many customers and users who are at the point where they're scanning per pull request and using defect dojo to get real feedback on the quality of those pull requests. So as soon as the code is submitted, from our perspective is the right point to start evaluating.

And where does this fit alongside my, say, CICD platforms, a lot of which are positioned now as DevSecOps platforms. What ultimately is the relationship gonna be between all these DevSecOps platforms and these A SPM platforms? So with regard to CICD platforms, we aim to bring visibility.

So you may have your security tools already running in CICD, but you may have issues with the quality of those results, like you mentioned, or with just knowing, uh, what findings all those different tools are surfacing. And so we can plug into those CICD platforms, um, a bring you the visibility to what those tools are finding in a, uh, concise and consolidated and de-duplicated manner. And then b um, we can help you to make intelligent decisions within those pipelines based on, um, the work the platform's doing to both, um, accurately identify, um, what findings you're actually impacted by versus what the tool is reporting.

You mentioned machine learning algorithms, so I'm assuming you're using those to discover some of these issues, but, you know, generative AI is all the rage these days. Is that something you're working on in the community about how to use gene ai? Maybe to facilitate some of this?

We, we've done a lot of back testing with generative AI to understand, uh, if large language or large models in general can help security or, um, how res how precise those results can be. And generally speaking, we haven't seen good results with large models, which, um, really validates our thesis on machine learning and at least from our perspective. And so, um, it's a much more targeted approach based on the individual customer.

I think the thing that makes large models difficult is the disparity of the data, essentially. Um, the key characteristics of one type of vulnerability are very different from the next. And so that can make it hard for an AI to make accurate assumptions over of very large data set security.

Do we therefore need maybe more domain specific LMS that we've trained for the express purpose of cybersecurity? I, I think so. With, with generative AI specifically, I, I think small models are going to be the long-term answer, but we just haven't seen anything definitive to just solve the problem outright in the generative AI space.

In your assessment, all of those DevSecOps issues that we've been having for quite a while now, how much of this is a technical issue versus a cultural issue in your mind? I think it's both. I think it's both.

I think the challenge of securing companies is, is harder than ever. Um, softwares is kind of like milk in that it doesn't particularly age well, it tends to spoil. And so when you look at vulnerabilities over time, like it, it's without a doubt increasing.

And so there is more than ever that people have to tack tackle. And on top of that, you know, e everyone's working very hard with inside companies. Developers don't wanna slow down to fix security issues.

And so I I, I think it's both. I think you have to have buy-in to be successful from your engineering counterparts, but at the same time, you have to bring the right technologies to the table to enable remediation. It also seems we don't really reward developers for fixing vulnerabilities and bugs and things like that.

There isn't this, you know, uh, small cheering section guy, Hey, that was an awesome thing you did. We reward the speed at which the code is developed. So do we need to kinda reassess some of our, uh, metrics for what we're tracking here to kinda encourage developers more to do the right thing?

Without question, without question, right? If, if the only thing that you're tracking is how quickly you ship code, that can put development certainly at odds with security. Um, because the reality is any sort of quality checks, whether it's, you know, security or, or QA, is going to have some impact on the process.

It's hard to ascertain who was really in charge of all of these application security issues. And to be frank, sometimes it's been treated as, uh, the redheaded stepchild, the security people thought the development people were doing it, and the development people thought the security people were doing it, and, um, invariably nobody was doing anything. So, uh, where does the budget for this kind of sit and then who is in charge of deciding, well, what tools and platforms are we gonna use?

That's a great question. I I think it, it varies on the company's maturity and their size. Um, we've worked with, uh, companies that are more developer focused, but have security budget.

I don't think we've seen a really consistent structure to what makes security successful. I do think security should generally be a separate function for the purposes of, um, separation of duties. You don't want your security team to be, um, influenced or have motivations that aren't at odds with their mission, which is keeping your company secure.

And so for, for those reasons, I think they should be separated, but sometimes there's a difference between, um, uh, theory and, and what you can realistically do. So there's $7 million. Nice tidy little sum there.

Um, what's your plan for that? I mean, where does that investment go from your perspective? Uh, so we're looking to do a number of things.

So first we, we have to go meet the demand that we already have. Um, dojo is a massive community, and so one of which is, is just purely responding to, um, what is coming through the door. And then two, we want to go back and, and essentially double down on our open source strategy.

So in the early days, we really had to focus on, um, pro and getting these new insights into the platform and differentiating from open source. And what this funding gives us the opportunity to do is, is go back and invest in that open source community because that's what we think makes us special. And, um, what we've continued to improve the open source platform, we wanna do a better job there for our open source community.

What, and, and just how big is this community? I'm not sure a lot of folks know, and a lot of times when you think of security, open source doesn't come to mind. It's hard to put an exact number on it.

So in the, we, we have a dedicated channel within OAS Slack instance that has several thousand members. Um, our GitHub gets 70 to 80,000 visits a month, but you know, sometimes people don't even come back to GitHub after they've pulled the source down. Um, we have 38 million downloads in Docker hub alone.

And so, um, it's, it's large. It's definitely international. Um, exact numbers are, are hard to say, but hopefully that gives you some sort of ballpark of the level of participation.

And we have 400 con plus contributors as well. And the, the professional edition that you're working on, where does that fit in the portfolio? Our philosophy on open source versus commercial is, um, first commercial enables us to do what we want in the, the space overall.

Um, it's, it's seems, uh, if not impossible to do one without the other, with regard to open source. We want it to have a very specific value prop but also not limit what people can go out and achieve with. So, um, from a philosophical perspective, we see open source as an aggregator, you can bring all your security data in, you can get value from the reporting, and if you want to, you can go build a ton of automation.

Um, pro out of the box contains insight, it contains data enrichment, it contains, um, an enterprise grade user experience, new ways to automate. And so, um, it gives you everything essentially versus choosing to just use the engine and go build the rest of the car. And you kinda look at this whole category and, you know, there's a lot of issues as we've kind of sorted out here, but was there one thing that kind of makes you shake your head and go, folks, we need to be better than this?

Oh, uh, great question. So, um, when I first started my career in security, I, I was very disappointed at what we were delivering and to developers and how hard we were working just to get to that level of results, if you will. And so, um, the number one thing security has to do is produce better results in a timely fashion.

And then we need ways that make sense to prioritize within those as well. And so, um, it, going back to your point about culture tech, I think we're essentially, um, we're, we're looking how we achieve that better culture through technology. And I think that's key for any program success is, is having the buy-in all around.

And, and we facilitate that through the technology. All right folks, well, you heard it here, it still takes a village. Um, but the bigger the village, the more likely it is that good things are gonna happen.

So theoretically at least open source is the route to the bigger village. And Greg, thanks for being on the show. Thank you so much, Mike.

Really appreciate it. Alright. And back to you guys in the studio.