One of my goals for this year is to read more. In that effort, I decided to finish reading “Application Security Program Handbook” by Derek Fisher , which I had started to read a while ago.

The book is divided into three parts: Defining Application Security, Developing the Application Security Program, and Deliver and Measure. There were a lot of good nuggets of wisdom embedded into familiar concepts that made all the chapters of the book valuable to read. However, I think that “Deliver and Measure” provided the most new information on the considerations of actually implementing the program and some of the challenges that I have seen first hand.

One of the more interesting concepts was introduced in chapter 6 and talks about measuring and managing a “risk budget” for each product. This involves defining a risk budget (in dollars estimated dollars lost from an incident or breach) for the product based on the risk tolerance of the organization and calculating how much of the budget is spent by existing vulnerabilities. Once the spent risk exceeds the risk budget, additional scrutiny can be applied, including blocking releases. In the examples, it used estimated loss in terms of dollars of an incident or breach. I thought this was an interesting idea to give product teams more control over the security choices and outcomes of their services, while still providing guardrails that protect the service.

While I liked the idea of using dollars lost to determine the risk budget, I haven’t seen what I would consider a decent way of actually calculating that amount. In the examples provided in the book, they provide a risk budget for an ecommerce site, which seems reasonable. But, extending that into an enterprise using a microservice architecture where there are dozens or hundreds of services used to provide each product becomes a much larger challenge. Core services such as authentication and authorization may be obviously critical to the functioning of the application, but what of the dozen others used to provide the product? The task of calculating the impact if one of a dozen or more services a product uses to various degrees is daunting, to say the least. I would hope that there are solutions to that challenge that I’m just not familiar with.

Overall, I liked the book. If you are new to building out an application security program, I think the book can provide valuable insight whether you are technical or not.