The AppSec Poverty Line: Minimal Viable Security (Tanya Janca)
summary
Defines an “AppSec Poverty Line” as the smallest set of controls under‑resourced teams must implement: input validation, parameterized queries, output encoding, modern runtimes, HTTPS, logging and monitoring, outsourced auth/payment, dependency checks, and a one‑conversation threat model. Advises running free scanners like ZAP or Nuclei and to pass a basic DAST and fix findings, add security.txt for reports, and use OSS tools (CodeQL, semgrep, truffleHog, gitLeaks). A 2024 survey of 60 companies shows many are below this line.
AI-written summary · about
chapters (11)
- 0:00Introduction and welcome
- 1:10Why minimal viable security
- 6:49Ten essential security controls
- 15:43What small teams can ignore
- 20:40Free developer training resources
- 24:36Building security culture
- 27:47Open-source security tools
- 28:49When MVS isn't enough
- 31:17Scaling security gradually
- 33:02Summary and call to action
- 35:27Q&A session
related talks
42mBuilding an AppSec Program with a Budget of $0: Beyond the OWASP Top 10
33mMinimum Viable Security
57mKeynote: Maturing Your Application Security Program
52mApplication Security at DevOps Speed and portfolio scale
29mAppSec on a budget
26mHow to Build an Application Security Program
47mSecurity is Everybody's Job
30mEffective security on a tight budget