The Application Security State of the Union
summary
Vendors and orgs still treat AppSec as tools first but the data is concrete: vulnerability volumes climb multiple‑times year over year (many report 2–5x increases), supply‑chain attacks rise ~742%, and 87% of container images have critical vulnerabilities while 90% of granted container permissions go unused and Kubernetes runs in ~49% of production environments. Practical stack: SAST, SCA, RASP, pipeline controls; DAST fails at DevOps scale. Recommendations: adopt OWASP SAMM, instrument runtime, consolidate tooling, and pursue SBOM/signing like Let’s Encrypt for packages.
AI-written summary · about
chapters (24)
- 0:00Intro
- 0:13Chris Romeo
- 2:33The definition of application security
- 3:51An Application Security State of the Union
- 4:51Environment: state of the language
- 7:22Environment: cloud native
- 8:21Environment: containerization
- 9:26Environment: container security
- 10:28Environment: orchestration
- 11:08Environment: cloud complexity and lac
- 12:32Environment summary
- 14:20Tools and services in use
- 16:07The activities of AppSec
- 19:42OWASP Top 10 CI/CD Security Risks
- 20:30OWASP AI security & privacy guide
- 22:44Software Supply Chain Impact
- 24:13Summary of AppSec
- 25:15The rest of the OWASP Universe saves the day?
- 27:52State of the art with people
- 30:18State of the art process & governance
- 31:31State of the art tools & technology
- 35:15Future Thoughts...
- 42:18Key Takeaways
- 43:27RSAConference 2023
related talks
53mFlipping the Script on Application Security
41mAim-Ready-Fire
52mApplication Security at DevOps Speed and portfolio scale
47mSecurity is Everybody's Job
33mWhy Developers Struggle with API Security
46mApplication security from start to finish
53mLessons Learned: A Retrospective on Application Security Failures
26mBeyond Testing: Application Security in the Age of DevOps