From Application Security to Developer Security
summary
Slides assert US losses reported to IC3 double to $12.5 billion and use concrete examples: the event-stream supply‑chain compromise (malicious flatmap-stream that steals wallets above 100 Bitcoins), a live demo of CodeQL with Copilot autofix that generates and commits a patch, and automation via Dependabot auto PRs plus SBOM export. The stack of recommended tooling names GitHub Advanced Security features: Secret Scanning with provider revocation, Codespaces/Dev Box virtual dev environments, Dependabot, and Security Overview.
AI-written summary · about
chapters (17)
- 0:00Developer security shift
- 4:16Introduction
- 5:20Hacking misconceptions
- 7:03Event Stream incident
- 10:33Attack vectors on devs
- 13:23Why devs are targets
- 15:11Social engineering
- 17:17Typo squatting and malicious dependencies
- 18:41Stealing dev secrets
- 22:58Security awareness
- 25:01Virtual dev environments
- 26:50Code scanning
- 29:58GitHub Advanced Security
- 35:18Secret scanning
- 38:44Supply chain with Dependabot
- 41:52Security shift metaphor
- 42:36Q&A
related talks
54mFrom App Security to Dev Security – Shift left with GitHub Advanced Security
46mApplication security from start to finish
49mPanel: From Code to Defense: Why Developers Are the New Security Leaders
53mFlipping the Script on Application Security
59mSecurity as Code: A DevSecOps Approach
50mThe Application Security State of the Union
33mSecurity as Code: A DevSecOps Approach
19mFlipping the script on application security