AppSec Timeline: Wins, Failures, Promises, and Predictions
summary
Stats: 32% information leakage, 18.3% cross-site scripting, 20% insufficient transport protection, multiple severe flaws per site and 7.3 HTTP response splitting per site and fix times measured in months — healthcare 337 days, information 336, high severity ~265 days, critical ~200 days. Diagnosis: SAST DAST SCA tools built 2000–2007 are too slow, require experts, and miss APIs and SPA. Prescription: purpose-built, cloud- and community-native, fully automated tools that run in CI/CD and test business increments.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 3:54Vulnerabilities
- 10:40AppSec vs Traditional Technologies
- 12:17Automation is equal death
- 14:33Shift to the left
- 15:20DevOps welcomes security
- 16:54Trends impacting AppSec
- 18:37Upfront Conclusion
- 20:29Why Traditional AppSec Technologies Fail
- 22:49Application Security Testing is Coming to an End
- 24:48Summary
- 29:07Recommendations
related talks
39mHard to Port! - A Snapshot of the Vulnerability Landscape in 2015
40mNurture vs. Nature in AppSec: Data-Driven Measurement of DevSecOps
44mApplication Security: Everything we know is wrong
46mThe Supply Chain Conundrum: Why Traditional Application Security Is...
28mLearning from High Profile Failures
46mBenchmarking AppSec Across Industries
55mBreaking and Fixing Web Application Security
53mFlipping the Script on Application Security