Prioritizing Trust While Creating Applications
Talkat SREcon19 Europe/Middle East/Africa · on Thursday, 2019-10-03· at 16:00· Track 2: The Liffey A·
summary
Argues that security must shift security left into design and CI/CD by threat modeling, tagging security stories, and feeding findings back into pipelines; recommends concrete tools and practices: OWASP ASVS for app checks, dependency scanning and GitHub alerts, building and patching images from known bases, linting and tests, secure code reviews, and a minimum viable response plan. Cites Heartbleed, the have I been pwned site, Verizon’s finding that attackers are mainly financially motivated.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 0:29Effective DevOps
- 7:55Core to Security
- 10:14Why do people hack
- 15:07Security stories
- 17:03Threat modeling
- 17:57Architectural tradeoffs
- 18:53Deployment options
- 19:37Shared security
- 20:49Testing code
- 21:21Lint code
- 22:25Linting
- 22:58Secure Code Reviews
- 24:15Security Concerns
- 25:09Different Platforms
- 26:19Recap
- 26:44Advanced Principles
- 27:35CTF
- 28:18Red Team
- 28:57Security Maturity
- 30:43Continuous Security
- 31:04Questions
related talks
31mPrioritizing Trust while Creating Applications
35mPrioritizing Trust while Creating Applications
01h 04mShifting Security Everywhere
57mMaking Security Priority Zero
40mMaking Security an integrated part of the SW Dev Lifecycle
29mSecuring Your Web Application Pipeline From Intruders
33mInterview with
26mBeyond Testing: Application Security in the Age of DevOps