# Ravindu Fernando — Application Security Consultant

> Ravindu Fernando is a Colombo-based Application Security Consultant. He assesses web, API, mobile and cloud application security for banks and enterprises across Sri Lanka, South Asia, the GCC and APAC, and recommends prioritised fixes. He also heads the Application Security Business Unit at Innov8 (Pvt) Ltd.

Key facts:
- Name: Ravindu Fernando
- Role: Application Security Consultant; Head of the Application Security Business Unit at Innov8 (Pvt) Ltd
- Location: Colombo, Sri Lanka (GMT+5:30); works remotely across South Asia, the GCC and APAC
- Model: assessment first, then prioritised recommendations; execution is scoped case by case (client team, a partner, or Innov8's AppSec BU)
- Client names are withheld under NDA; delivered work is described anonymously below

## How engagements work
- 01 Assess: I audit your applications and the security capabilities you already have: edge, APIs, code, monitoring, mobile and governance. Evidence, not questionnaires.
- 02 Recommend: You get a prioritised plan: what to fix first, what it costs, what risk it removes, and what can wait.
- 03 Execute, case by case: If you want help delivering, I scope it case by case: the expertise and manpower it needs, the timeline, and who is best placed to do it — your team, a partner or Innov8’s AppSec unit.

## What every assessment covers
- 01 Edge & WAAP: Is hostile traffic stopped before it reaches your applications? Checks: WAF / WAAP coverage and blocking mode; Bot and abuse controls; DDoS readiness; Origin exposure and bypass paths.
- 02 API security: Do you know every API you expose, and who can call it? Checks: API inventory and shadow APIs; Schema enforcement; Authentication and object-level authorisation; OWASP API Top 10 (2023).
- 03 Vulnerabilities & exposure: Are you fixing the weaknesses an attacker would actually use? Checks: Scanner coverage and credentialed scanning; SAST / DAST in the pipeline; Prioritisation beyond CVSS (CTEM); Time to remediate by owner.
- 04 Monitoring & visibility: Would your SOC see an application attack while it is happening? Checks: Security log coverage; SIEM integration and pipeline health; Detections for application attacks; Alert ownership.
- 05 Mobile apps: Can your customer app defend itself on a device you do not control? Checks: In-app protection and RASP; Anti-tamper and anti-hooking; OWASP MASVS-aligned testing; Runtime threat telemetry.
- 06 Governance & maturity: Is application security owned, measured and funded? Checks: Ownership and policy; OWASP SAMM v2 maturity score; NIST CSF 2.0 alignment; Roadmap and budget.

## Engagements (fixed scope)
- AppSec maturity assessment (2–3 weeks, Fixed fee): Whole organisation, all six areas, OWASP SAMM v2 based. Deliverables: Scored baseline, gap analysis, 12–24 month roadmap, board summary.
- Application architecture review (1–3 weeks, Fixed fee): One critical application or platform, edge to code. Deliverables: Threat model, control coverage map, prioritised fixes.
- WAAP & API protection assessment (2–4 weeks, Fixed fee): Web and API estate, current WAF/WAAP and bot controls. Deliverables: Coverage gaps, bypass paths, migration or tuning plan.
- Mobile app security assessment (1–2 weeks, Fixed fee): Customer-facing iOS and Android apps. Deliverables: Mobile threat model, protection policy, MASVS test plan.
- Exposure management (CTEM) assessment (2–4 weeks, Fixed fee): Scanning, testing and remediation process. Deliverables: Prioritisation model, validation approach, owner playbook, metrics.
- Executive briefing or team workshop (½–1 day, Fixed fee): Board, CISO or engineering audience. Deliverables: Plain-language risk briefing or hands-on workshop.
- Fractional AppSec advisor (Monthly, Retainer): Ongoing senior guidance after an assessment. Deliverables: Roadmap governance, vendor and design reviews, escalation support.

## Delivered work (anonymised)
- A leading Sri Lankan private bank: Cloud WAAP migration at enterprise scale on F5 Distributed Cloud. Moved roughly 112 web applications and APIs to cloud web application and API protection in waves, from monitoring to blocking.
- A global apparel group headquartered in Sri Lanka: WAAP, API security and advanced bot protection on Imperva. Deployed web application, API and advanced bot protection across around 120 applications for a multinational manufacturing group.
- A Tier-1 Sri Lankan commercial bank: Vulnerability management modernisation on Tenable Security Center. Upgraded the vulnerability management platform and deployed web application scanning to cover the application layer.
- A leading private bank’s mobile app: Mobile application runtime protection on Zimperium. Rolled out in-app protection for a customer banking app, tuning policies and supporting SDK integration with the bank’s developers.
- A leading Sri Lankan private bank: WAAP security telemetry into the SOC on F5 → Logstash → Trellix SIEM. Integrated WAAP security logs into the bank’s SIEM through Logstash and resolved pipeline backpressure so events arrive reliably.

## Innov8 Application Security BU (implementation and managed services)
- Application & API protection: WAF, WAAP, API security, bot mitigation and CDN, deployed and tuned for production.
- Mobile application security: Runtime protection, app shielding and mobile security testing.
- Security assessment: Vulnerability scanning, SAST, DAST and VAPT.
- Monitoring & visibility: Security logs, observability and SIEM integrations.
- Managed security services: Policy tuning, threat monitoring and ongoing operations.
- Licensing & support: Platform licences, renewals and certified engineering support.

## Pages
- [Profile](https://ravindufernando.pages.dev/): who Ravindu is, how he works, what he assesses, track record, contact
- [Consulting](https://ravindufernando.pages.dev/consulting): engagement formats, deliverables, FAQ
- [Innov8 AppSec BU](https://ravindufernando.pages.dev/innov8): implementation, technology portfolio, managed services
- [AppSec Maturity Scorecard](https://ravindufernando.pages.dev/scorecard): free 12-question self-assessment
- [Contact](https://ravindufernando.pages.dev/contact) · [Profile PDF](https://ravindufernando.pages.dev/ravindu-fernando-profile.pdf) · [Contact card](https://ravindufernando.pages.dev/ravindu-fernando.vcf)

## Insights
- [Measuring application security maturity with OWASP SAMM: a practical starting point](https://ravindufernando.pages.dev/insights/appsec-maturity-owasp-samm): A practical OWASP SAMM assessment guide: run a lightweight AppSec maturity assessment in 2–3 weeks, score honestly, set a target and build a security roadmap.
- [What 112 application migrations taught me about moving to cloud WAAP](https://ravindufernando.pages.dev/insights/cloud-waap-migration-lessons): Cloud WAAP migration lessons from onboarding ~112 applications: DNS cutover order, TLS compatibility, origin protection, staged blocking and SIEM logging.
- [From vulnerability lists to exposure management: CTEM for South Asian enterprises](https://ravindufernando.pages.dev/insights/ctem-exposure-management-south-asia): Continuous threat exposure management (CTEM) for South Asian enterprises: the five stages, better vulnerability prioritisation and how to mobilise owners.
- [Mobile app shielding for banks: what RASP protects, and what it doesn't](https://ravindufernando.pages.dev/insights/mobile-app-shielding-for-banks): Mobile app shielding and RASP for banking apps explained: the threats in-app protection stops, what it cannot replace, and how to tune policy without friction.

## Optional
- [Full text for LLMs](https://ravindufernando.pages.dev/llms-full.txt)