The shimmy to the left: why security is coming for engineers
summary
Argues that engineers must shift security left and shows seven runnable demos: local TLS with mkcert and an Echo HTTPS server, JWT-based auth with custom claims and bcrypt-hashed passwords, resource checks that reject mismatched tokens with 401, Postgres prepared statements to prevent SQL injection, CI checks with golangci-lint and gosec in GitHub Actions, and Go fuzz testing that finds a username validation bug.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 2:10DevOps to SecDevOps evolution
- 9:13Secure coding focus
- 10:36OWASP Top 10 vulnerabilities
- 15:55Secure coding best practices
- 16:17HTTPS and TLS handshake
- 20:28Demo: HTTPS server setup
- 24:01JWT authentication
- 26:31Demo: JWT in Go
- 36:46Resource access control
- 38:14Demo: Enforcing policies
- 41:25SQL injection prevention
- 42:27Demo: Prepared statements
- 43:52SecDevOps pipeline
- 44:12Demo: Linting in CI/CD
- 46:40Demo: Security scanning
- 50:37Demo: Fuzz testing with Go
- 55:16Key takeaways and conclusion
related talks
01h 04mShifting Security Everywhere
44mShift-Left-Security with the Security Test Pyramid
35mShift left the right way to build secure software
57mShift Left Security with the Security Test Pyramid
40mClosing Keynote: New Era of Software with modern Application Security
34mWeb security explored through horror movies
25mSecurity First
36mHow to build continuous security and embed it in your product