Learning from Past Security Breaches: Strengthening AppSec Efforts and Focus
summary
Practical, checklistable items and failed/working fixes drive the talk not high-level platitudes: cut a Jira ticket with metadata and run a 10–30 minute rapid assessment, use an intake form capturing stakeholders and assets (example: ML models exposed with Dynamo and SQS behind basic auth), move from raw diagrams to segmented red‑systems with owners for every control, keep runbooks for DDoS and malware, protect evidence with off‑site write‑only logging and a canary detection of no‑logs, and rehearse rebuilds on a different cloud.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 2:29PII leaks in apps
- 7:07Security in SDLC
- 13:06Denial of service attacks
- 17:23Malware and user threats
- 21:56Advanced persistent threats
- 25:44Incident response plan
- 32:09Q&A
related talks
01h 03mBe your own Threatbuster!
27mBridging the Dev-Sec divide: Three tips for agile developers
52mContinuous Security
57mBuilding a Modern Security Engineering Organization
53mPractical tips for web application security in the age of agile and DevOps
27mSecurity: The Thing That Everyone...
47mSecurity is Everybody's Job
33mInterview with