Keynote: AppSec: From Outsiders to Allies
summary
Narrative traces a concrete arc: early bug research finds broken access control in Lotus Domino that still tops OWASP years later; vendor coordination leads to coordinated disclosure with Microsoft and a Senate hearing that shifts perception; automation builds like the Spike fuzzer rapidly find many flaws; integrating testing via APIs and CI cuts average remediation by weeks (24.5 days for multiple techniques, 17.5 days for API-driven scans, half‑life of flaws from 25 to 13 days); attention now shifts to supply chain and SBOMs under new government rules.
AI-written summary · about
chapters (26)
- 0:00Introduction
- 1:50What people dont know about Chris
- 6:14Being an outsider
- 8:38My first vulnerability
- 10:35Developer appreciation
- 16:04Microsoft
- 17:44The Loft
- 21:27Outsiders
- 23:16Bill Gates
- 26:08Threat Modeling
- 31:04Fixing Issues
- 32:32Development Processes
- 33:49Evolving Developer Mindset
- 34:53DevSec converging
- 35:43DevSec Allies
- 36:28Building Relationships
- 37:07Shared Accountability
- 37:50Process Improvements
- 39:59Remediation Time
- 43:08Data
- 44:34The Future
- 44:45Supply Chain
- 46:10NIST
- 47:11Wrapup
- 47:50Becoming Allies
- 49:03Speed vs Accuracy
related talks
44mKeynote: 25 Years in AppSec: Looking Back, Looking Forward
01h 05mKeynote: 50 Shades of AppSec
49mKeynote: CISO Perspectives
16mKeynote: There Is Just One Way to Do Open Source Security: Together
13mKeynote: Software Security: _You_ are the Calvary
39mKeynote - The Abridged History of Application Security
53mKeynote
57mKeynote: Maturing Your Application Security Program