https://ismg.events/roundtable-event/denver-appsec/ Q: What is application security testing and why is it critical for modern development? Application security testing is a way to identify vulnerabilities in software before they are exploited. It's important to test for vulnerabilities in today's rapid-development environments because even a small vulnerability can allow sensitive data to be exposed or compromise a system. Modern AppSec tests include static analysis (SAST), interactive testing (IAST), and dynamic analysis (DAST). This allows for comprehensive coverage throughout the software development cycle. Q: Why does API security become more important in modern applications today? A: APIs are the connecting tissue between modern apps, which makes them an attractive target for attackers. Proper API security requires authentication, authorization, input validation, and rate limiting to protect against common attacks like injection, credential stuffing, and denial of service. Q: How should organizations approach security testing for microservices? A: Microservices need a comprehensive approach to security testing that covers both the vulnerabilities of individual services and issues with service-to service communications. This includes API security testing, network segmentation validation, and authentication/authorization testing between services. Q: How can organizations effectively implement security champions programs? A: Security champions programs designate developers within teams to act as security advocates, bridging the gap between security and development. Effective programs provide champions with specialized training, direct access to security experts, and time allocated for security activities. Q: What is the role of property graphs in modern application security today? A: Property graphs are a sophisticated method of analyzing code to find security vulnerabilities. They map relationships between components, data flows and possible attack paths. This ap