AppSec is Eating Security
summary
Claim: application security dominates the next 20 years because software is eating the world and most companies are unprepared — roughly 100 of the Fortune 500 can play the game while about 400 cannot. Hardware security fails at scale: an Arista switch with 1152 10 GB ports and ~30 terabits per second of backplane needs about 250 Palo Alto boxes / 600 kW to inspect east‑west traffic. Containerization and 100 G networks mean wire‑speed inspection is unrealistic — 100 G = 6.7 ns ≈ 28 CPU cycles to decide per frame.
AI-written summary · about
chapters (14)
- 0:00Start
- 4:44Most enterprises are not safe
- 10:16Almost no users are safe
- 16:19Containerization collapses the security perimeter
- 23:11The Internet of Unpatchable Crap Things
- 24:25Apps have to be secure by default
- 27:36App Sec doesn't have to be realtime or inline
- 34:37Bug bounty communities need to reform to grow
- 39:13Accept that the browser is the new OS
- 41:06Network Security must be transparent to applications
- 44:10Build apps that are safe, not just secure
- 45:15What is a safe app?
- 48:57Passwords are dead
- 56:15Shameless Pitch
related talks
05mEnterprise security: A new hope
50mThe Application Security State of the Union
22mExpert Insights | Keynote
52mApplication Security at DevOps Speed and portfolio scale
30mThe AppSec Error Loop: How We Can Stop Repeating Common Security Mistakes
38mAppSec is Dead Long Live DevSecOps!
24mSecurity in 2023 and Beyond: Automation, Analytics and Architecture
31mTopics of Interest: Scaling AppSec through Education