In a recent chat about Web app security (WebAppSec) with Georg Hess, prominent OWASP member and CEO of art of defense, a Regensburg, Germany-based application security provider, some interesting thoughts were raised. Hess discussed the need for a new role that would blend development, IT and networking experience to ensure better WebAppSec and bridge the gap in communication across the departments.

He also pointed out that large organizations already have WebAppSec teams that follow an application's entire lifecycle, but proposed a new role for smaller to mid-sized organizations: a WebAppSec manager. "It's a new role," he said, "not necessarily a new person.”

It’s basically the same concept as what is already going on in larger organizations, but is something that is needed in all size organizations to ensure WebAppSec, Hess said. This dedicated role would be responsible for the application’s security while in development or live. 

Hess also discussed other precautions that can be taken for WebAppSec, such as a Web application firewall (WAF). “This at the very least can be a second line of defense,” he said, whether for a cloud provider or anyone with a Web application. 

Once Hess mentioned cloud security it got me thinking that maybe it’s time to visit this topic more in depth. I don’t care to divulge anymore of what we discussed at this moment (more of that is to come), but I certainly think it’s a topic that deserves a comprehensive look.