Fix The Damned Software
Talkat AppSec California 2015 · on Tuesday, 2015-01-27· at 18:15· Annenberg Community Beach House: Track 1, 415 Pacific Coast Hwy·
summary
Claims that testing alone just piles up bugs and that security must be built into frameworks and platforms backed by BSIMM and assessment data. Finds a 67% re‑exploit rate with the same tests, 98% when testers try different checks and 100% WAF bypass after rules. Case study using sappy forces changes to 70% of files and 78% of lines, whereas pushing controls into Spring conventions and a tokenization service reduces edits to ~5 files (12% lines) and delivers measurable vulnerability reduction.
AI-written summary · about
chapters (4)
- 0:00Start
- 6:22Improvements to the Way We Test
- 11:38Intelligent Design for Frameworks
- 15:35Microservices
related talks
44mApplication Security: Everything we know is wrong
01h 06mEscaping Vulnerability Hell: Bridging the Gap Between Developers and Security Teams
55mBreaking and Fixing Web Application Security
27mHow Security, Development & Testing can work together to stop ...
33mBattle Tested Application Security
39mSoftware Security Engineering (Learnings from the past to fix ...)
43mSecurity Testing Tools: Can I Touch You There?
37mHow to get developers to want to adopt AppSec