Breaking Into AppSec: Hack Your Way Into Cybersecurity!
Introduction
Breaking into Application Security can feel overwhelming at first. However, it's one of the most rewarding and dynamic fields in cybersecurity. You might be a newcomer to the industry, a software engineer or product manager looking to make a career pivot, or an existing AppSec engineer looking to upskill. Whatever your background, there's a lot to learn, and we're here to help you get started!
In this blog post, we’ll cover what Application Security is, the skills you need to break into the field and how to acquire them, and great ways to network and increase your chances of getting a job!
What is Application Security?
Application Security (AppSec) is a specialization within cybersecurity that focuses on ensuring that applications are designed, developed, and deployed securely. AppSec engineers work with development teams to transform product requirements into secure applications. They develop secure paths for engineers and conduct penetration tests on new products, features, and services.
The scope of an AppSec engineer's role can vary significantly between companies, including being conflated with and used interchangeably with the closely related discipline of Product Security. However, the typical responsibilities of an AppSec engineer will include:
Secure code review
A significant part of application security involves reviewing codebases for vulnerabilities. AppSec engineers audit code to identify and prevent security issues such as SQL injection, cross-site scripting (XSS), and other vulnerabilities listed in the OWASP Top 10.
Threat modeling and risk assessment
As you grow in your AppSec career, you'll learn to identify potential threats in applications before they're even written. You'll evaluate the risk posed by vulnerabilities and other technical decisions. This helps engineers and executives make informed prioritization decisions.
Penetration testing
Penetration testing involves comprehensive security testing of a system. It can include both black box testing (testing without knowledge of the system internals) and white box testing (testing with full system knowledge). A skilled penetration tester must understand how to threat model and design attack plans with minimal system information, so it’s very important to master threat modeling.
Building an AppSec Skillset
AppSec professionals need both broad knowledge and deep expertise to be most effective. To start, let’s focus on three key areas: software development, IT fundamentals, and Application Security principles.
Software Development skills
AppSec roles will involve extensive collaboration with software engineers and code review. As such, a strong understanding of software development is essential.
Start by learning a common programming language used for web and backend development, such as Python, JavaScript, or Golang. You may also want to consider learning Swift or other mobile languages.
You should also understand the Software Development Lifecycle (SDLC). This includes knowledge of Continuous Integration (CI) and Continuous Deployment (CD), static analysis, and engineering communication practices.
Great resources for this include Harvard’s CS50 Class and Khan Academy.
Networking and Operating System basics
While you don't need the same depth of knowledge as a Cloud engineer, understanding how code interacts with deployment environments is crucial. Key areas include TCP/ IP, Linux and/or Windows security concepts, and cloud environment best practices.
TryHackMe's Network Fundamentals course offers an awesome starting point for beginners.
Application Security Fundamentals
Once you have a solid technical foundation, focus on Application Security fundamentals.
This includes:
- Common vulnerability types and their code manifestations, such as the OWASP Top 10 lists
- Browser security standards and how they protect users (CSRF, Content Security Policies)
- Secure coding practices, such as the details of cryptography, authentication and authorization, and defensive programming techniques
- Learning about security tooling, such as the ZAP Scanner and Semgrep
Some great places to start learning about these are:
- The OWASP Top 10 lists, especially for Web and API security
- The OWASP Mobile Application Security Verification Standard (MASVS) is also a great place to learn about Mobile Application Security, a subdiscipline within Application Security.
- PortSwigger’s Web Security Academy classes are a fantastic way to learn, practice, and apply theoretical concepts; they provide both excellent source material and a lab environment in which you can apply knowledge.
- Other online resources, such as:
- Cryptopals for learning cryptography
- HackTheBox also has online labs for practicing AppSec and penetration testing
- Books
Breaking into the Industry
Building skills is just the first step. Now that you’re technically skilled, here's how to establish your reputation and network effectively:
Open Source Work
Contributing to open-source projects can significantly boost your industry presence. Consider contributing to large projects such as Semgrep, Nuclei, or certain other OWASP projects; these projects always need new help for feature work. Check out this GitHub repository for a huge list of other open-source security projects as well.
You could even choose to develop and publish your own projects. Make sure to share your work on Hacker News and Lobste.rs to let the community know!
Bug Bounty
Bug bounty hunting offers both practical experience and potential income. Many companies and organizations have “responsible disclosure” programs where security researchers can report vulnerabilities for recognition or compensation. This work is a great way for security researchers to start working on projects in the wild and learn communication skills that are necessary as an Application Security engineer.
Start with large programs like the Department of Defense, which offer extensive testing opportunities since they have a huge surface area. Even unpaid programs may be worth the effort, as you’ll be able to build out your skills and have good material to blog about.
Conferences and Meetup Groups
Conferences can be a great way to meet like-minded individuals and learn about cutting-edge research. Some may even have workshops to get hands-on knowledge.
Notable Application Security focused conferences include:
For ongoing community engagement, there are also virtual and potentially local meetup events for security professionals. Virtual communities such as the OWASP server, InfoSec focused Mastodon servers, and other mailing lists.
There may also be a local DefCon meetup group depending on the area that you live in. Also, check your local Meetup.com page for other cybersecurity-related events.
Certifications
Certifications can also be a valuable way to show your expertise in various fields within cybersecurity. However, there typically is a financial cost to getting a certification; ensure you’ve done all of the free things above before trying to get a certification!
There are several good options here:
- CompTIA Security+
- This is the best entry-level certification for anyone trying to get their first job in Application Security.
- OffSec’s Advanced Web Attacks and Exploitation (OSWE)
- Complementary to the OSCP certification, the OSWE is a hands-on certification focused on web application penetration testing and white box source code analysis, both skills that translate directly to an application security career.
- Burp Suite Certified Practitioner
- The BSCP is also highly focused on web exploits and penetration testing; it also demonstrates competency with Burp Suite, an industry-standard penetration testing toolkit.
Taking the Next Step
Now that you’ve built out your skillset and your reputation, it's time to launch your AppSec career. Make sure to keep an active online presence through LinkedIn and a personal blog.
Search for jobs such as “Application Security Analyst”, “Application Security Engineer”, “Product Security Engineer”, and “Security Analyst” on job boards like LinkedIn and Indeed.
We're also actively hiring here at Cloud Security Partners. Check out our open positions and reach out if you think you'd be a good fit!