Security Design Anti-Patterns – Creating Awareness to Limit Security Debt
summary
Lists 12 concrete security anti patterns and shows how they arise during threat modeling with manual prototyping versus limited automation that only finds single‑hop threats it demos specific failures: using an all‑or‑none API token, omitting role values from JWTs, running batch jobs without user authorization, unprotected cron or queue payloads, search engines undoing de‑identification, PKI expiry pain and rate limiting that breaks with autoscaling it offers fixes too a threat‑pattern library, starter templates and platform services and notes when fixes require redesign versus simple config changes
AI-written summary · about
chapters (19)
- 0:00Introduction
- 0:30Agenda
- 1:14Background
- 3:35Security Controls
- 5:33Security Debt
- 7:29Conceptual AntiPattern 1
- 9:54Stateful Web Application
- 14:39Power User Example
- 17:13Zero Trust Architecture
- 21:23Performance Integration Testing
- 27:23Cloud Event Trigger
- 27:57What can we do
- 29:01Systems that dont mix
- 33:24Systems that dont match
- 35:13Systems that create issues
- 37:14Scalability vs Scaling
- 39:41Creating Awareness
- 41:44Learning from Developers
- 43:03Proactive Security Features
related talks
50mYou’re Doing It Wrong! Common Security Anti Patterns
51mSecure Applications, By Design
43mSecurity By Design
01h 02mLock That Sh*t Down! Auth Security Patterns for Apps, APIs, and Infra
45mSecurity Architecture, An Adventure?
39mAnti-Patterns: How to Not implement a Cloud Security tool
29mThreat Modelling 101
33mLearning from Past Security Breaches: Strengthening AppSec Efforts and Focus