Shifting Knowledge Left: Keeping up with Modern Application Security
summary
Claims that OWASP Top 10 and annual slide decks aren’t enough, citing GitLab’s finding that 70% of developers are expected to write secure code while fewer than 50% get security feedback, and HackerOne’s data showing SSRF/IDOR pay outs and only 40% overlap with OWASP. Duo builds intro and advanced app sec courses plus a sandbox with 20+ labs, integrates Slack/office-hours and CI alerts, and ships a replay‑attack Flask lab where adding randomness to the request hash prevents the exploit, demonstrating the training fixes real code.
AI-written summary · about
chapters (14)
- 0:00Start
- 11:20HPKP Timeline, cont.
- 12:51More Code, More Problems
- 14:34Wishful Thinking as Vulnerability Management
- 17:29Relative Cost of Fixing Defects
- 20:36Risk Versus Reward
- 22:16ORM: Not SQLi Proof!
- 27:22OH: Security Conference Talk
- 28:39Centering Team Focus Beyond "Find Bugs"
- 35:07Raise the Bar for Your Engineers
- 37:14An AppSec Office Hours Anecdote
- 38:26ICAP Learning Framework
- 43:29Cyber Security Awareness Month October 2019
- 45:47Duo-created Lessons for Hunter2
related talks
20mHow to Use Your Vulnerabilities to Train Your Developers on Security
54mFrom App Security to Dev Security – Shift left with GitHub Advanced Security
49mFrom Application Security to Developer Security
30mThe AppSec Error Loop: How We Can Stop Repeating Common Security Mistakes
31mTopics of Interest: Scaling AppSec through Education
57mThe Developer's Field Guide to Software Security
36mApp Security Does Not Need To Be Fun: Ignoring OWASP To Have A Terrible Time
44mShift-Left-Security with the Security Test Pyramid