How Leading Companies Are Scaling Their Security
Talkat OWASP AppSec Europe 2018 · on Thursday, 2018-07-05· at 14:15· Westminster - 4th Floor, QEII Centre Broad Sanctuary, Westminster·
summary
Companies describe concrete measures and results: automated scrapers of Slack and JIRA to surface security-relevant work, internal threat‑model webapps that auto-create tickets, CI hooks that block new inline JavaScript or prevent secret commits, lightweight static checks on developer machines, fuzzing clusters that find 12 or 13 unique crashes in days, runtime canaries and an override alert telemetry trick to detect XSS, and automation like RepoKit-style auto‑revoking of excessive AWS permissions.
AI-written summary · about
chapters (9)
- 0:00Start
- 3:49developing new standards
- 15:20writing safe and lightweight static analysis check
- 17:00blocking new editions of anti-patterns
- 21:45configure your integration test
- 23:35set up a fuzzing cluster
- 24:30establish a clean api
- 38:54scaling your security
- 42:45adding telemetry
related talks
21mSecuring a Security Company
47mHow to 10X Your Company’s Security (Without a Series D)
57mBuilding a Modern Security Engineering Organization
58mBalancing Security and Agility While Scaling Your Company
42mContinuous Security: Integrate security tools into your DevOps Pipeline
54mScaling Security in Agile Scrum
41mSkillful, Scalefull Fullstack Security in a State of Constant Flux
32mAutomating Security Compliance at Scale