Closing Keynote: New Era of Software with modern Application Security
summary
Claims that application security practices double as software quality tools and show how to stop shipping fragile systems, with concrete toolset and workflows: TDD with code coverage enforced on every commit, Dockerized test environments, clever fuzzing plus runtime visibility via ELK, and a JIRA risk acceptance loop that forces managerial signoff. Demos include a MITM modification of a news site using beef in Docker, cheap hardware (rubber ducky / pocket Wi‑Fi) for local compromise, leaked AWS keys used to mine coins, and a 3‑request test that destabilizes a node app.
AI-written summary · about
chapters (23)
- 0:00Start
- 5:24I'M A DEVELOPER
- 6:09BOOKS
- 7:08MODERN APPLICATION SECURITY
- 8:02JIRA WORKFLOW
- 10:40Shopping For Zero-Days: A Price List For Hackers
- 13:59SQL INJECTION TOOL - HAVIJ
- 14:19XSS WORM - MYSPACE
- 14:34GET PAYED TO FIND XSS
- 24:30Demo
- 30:09TDD WITH CODE COVERAGE
- 30:39DOCKER AND CONTAINERS
- 30:51TEST AUTOMATION
- 31:025 CLEVER FUZZING
- 31:17WEB SERVICES VISUALISATION
- 34:13'FIXING' FLOW
- 34:27MAPPING TO INFOSEC RISKS
- 34:39JIRA DASHBOARDS
- 36:47MISSING TESTS
- 37:47REAL WORLD MUTATION TESTING
- 38:46SENIOR MANAGEMENT OVERSIGHT
- 39:06OpenSAMM (Security Assurance Security Model)
- 39:16BSIMM (Building Security in Maturity Model)
related talks
43mOpening Keynote - Flipping the script
13mKeynote: Software Security: _You_ are the Calvary
40mMaking Security an integrated part of the SW Dev Lifecycle
46mApplication security from start to finish
32mSoftware security as a force of nature
36mPanel Discussion: Modern App Security Requires Containers
40mKEYNOTE: Delivering software that is secure & usable - who’s job is it?
49mFrom Application Security to Developer Security