Keynote - The Abridged History of Application Security
summary
A 50-year timeline shows concrete wins: Polish researchers build the first modern cryptanalysis tools in WWII, 1979 Lint starts static analysis, 1995 SATAN begins automated scanning, 2001 OWASP and WebGoat create shared learning, 2003 Metasploit, 2015 DefectDojo orchestration, 2020 Semgrep for fast devops SAST, and 2016–2022 push HTTPS to 95% of Chrome loads via Let's Encrypt and TLS 1.3. Password hashing evolves from crypt and MD5 to bcrypt then Argon2id after the competition, XSS gets mitigations like CSP Level 3 and major browsers adopt it.
AI-written summary · about
chapters (12)
- 0:00Intro
- 2:45Welcome
- 4:45Introduction
- 6:10History of Security Testing
- 18:15Password History
- 25:25Open Web Application Security Project
- 29:25Crosssite Scripting
- 30:35Content Security Policy
- 32:00Safari
- 33:20Phil Phillips
- 34:10lucas
- 38:05Content Security
related talks
44mKeynote: 25 Years in AppSec: Looking Back, Looking Forward
56mKeynote: AppSec: From Outsiders to Allies
32mJavaScript security: a retrospective
51mKeynote: 20:20 The History and Future of OWASP
33m40,000 CVEs and Counting: What 60 Years of AppSec Tells Us About 2026
53mKeynote: Philippe De Ryck - AppSec is too hard?
01h 05mKeynote: 50 Shades of AppSec
36mKeynote: What's New or Not in 2020: Are we Making Progress?