Be your own Threatbuster!
summary
Concrete steps for small teams: perform threat modeling (STRIDE) per story to find entry points, assets and trust boundaries; prioritize low-effort, high-impact fixes first — e.g. hash passwords, use HTTPS and avoid logging secrets; automate dependency and static scans (SonarQube, image scanners), add security checks to CI and acceptance criteria, keep production credentials out of repos, and schedule targeted penetration testing for hard cases. Note the scale: the presenters cite ~40 billion breached records since 2013 and only ~4% encrypted.
AI-written summary · about
chapters (11)
- 0:00Start
- 8:14IT IS ABOUT THE LAW
- 10:21CAN SECURITY BE RETROFITTED?
- 14:21KNOW WHAT YOU ARE BUILDING!
- 17:33KNOW WHAT CAN GO WRONG (STRIDE)
- 34:02WHAT IS DEFINITELY NEEDED?
- 38:48ENCRYPT IN TESTS
- 44:36IT IS NOT JUST ABOUT THE SOFTWARE
- 56:15WHAT SHOULD I DO. TO RETROFIT SECURITY?
- 58:49PENETRATION TESTING
- 59:44SUMMING UP
related talks
27mBridging the Dev-Sec divide: Three tips for agile developers
52mContinuous Security
58mHow to embed security into your process
33mLearning from Past Security Breaches: Strengthening AppSec Efforts and Focus
38mPrioritizing Trust While Creating Applications
31mPrioritizing Trust while Creating Applications
01h 04mShifting Security Everywhere
01h 02mSo long secure coding... Hello secure development!