How Security, Development & Testing can work together to stop ...
summary
OWASP 2021 draft analyzes 500,000 applications and expands scope to roughly 400 CWEs, introducing insecure design (a cluster of ~40 CWEs) while merging injection with XSS and surfacing SSRF as a new top-ten entry. Evidence shows testing finds recurring bugs but does not remove root causes, 25% of breaches trace to human error and the average breach cost is near $4M. A developer-focused training platform (Secure Code Warrior) aims to shift left and reduce repeat vulnerabilities, but knowledge loss and siloed workflows keep bugs reappearing.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:41Agenda
- 1:25About me
- 2:15Top 10 through the ages
- 5:53The iceberg
- 7:15Statistics
- 10:00Personas
- 13:17SQL Injection
- 14:28Breaking the Cycle
- 17:48Embed Security
- 18:09Insecure Design
- 21:22Changing Culture
- 23:37Recurring Vulnerabilities
- 24:02Security Champions
- 24:45Summary
- 26:19Outro
related talks
43mSecurity Vulnerabilities Decomposition: Another way to look at Vulnerabilities
57mThe Developer's Field Guide to Software Security
23mWeb Application Security - owasp top 10 vulnerabilities
30mThe AppSec Error Loop: How We Can Stop Repeating Common Security Mistakes
20mHow to Use Your Vulnerabilities to Train Your Developers on Security
44mShift-Left-Security with the Security Test Pyramid
37mDeploying Security Testing Practice in Your Team and Company
26mBeyond Testing: Application Security in the Age of DevOps