Code Red: Navigating the Minefield of Security Programming Blunders
summary
Covers concrete failures (Apache Struts patch missed in 2017 that exposes 140 million records, Equifax) and a supply‑chain compromise (the SolarWinds backdoor that impersonates users), explains tools and mitigations used or recommended (SCA, prepared SQL statements, use Valgrind and fuzzing, pen tests, threat‑modeling), shows how simple mistakes — exception handling, hidden fields, RAM‑stored API keys or plaintext passwords — scale into massive breaches, and gives actionable checks that teams can run without code demos.
AI-written summary · about
chapters (18)
- 0:00Security programming blunders
- 1:17Focus on security fundamentals
- 8:51From hacking to security focus
- 13:44Evolution of security threats
- 20:11Equifax breach lessons
- 26:28SolarWinds supply chain attack
- 32:09Memory and resource vulnerabilities
- 37:20Dependency risks in software
- 42:36Fuzzing for security testing
- 47:13Red team exercises and threats
- 53:12CPU vulnerabilities and cache attacks
- 1:00:01RAM security risks
- 1:05:40API keys and cryptography
- 1:09:12SQL injection prevention
- 1:16:17Security architecture strategies
- 1:20:25Cryptographic strength
- 1:22:12Penetration testing importance
- 1:23:57Q&A
related talks
55mBreaking and Fixing Web Application Security
46mApplication security from start to finish
35mInside a hacker’s mind
23mSecure Code, Safe Future: Mastering Security in Critical Software Development
43m50 Shades of AppSec
35mCYBERSECURITY! The good, the bad, and the hacked
46mLive hacking: Breaking into your Java web app
59mPractical Security for Web Applications