Why Your AppSec Experts Are Killing You
Talkat AppSec California 2015 · on Wednesday, 2015-01-28· at 11:30· Annenberg Community Beach House: Track 2, 415 Pacific Coast Hwy·
summary
Argues that expert-led AppSec is a bottleneck and gives a concrete alternative: define an expected security model, deploy instrumentation-based testing sensors, and feed a sensor‑model‑dashboard loop. Demonstrates a free Eclipse plugin Contrast for Eclipse that instruments running Java apps, finds SQL injection XXE and insecure hash use with full traces, shows the demo works in real time, cites 22.4 serious vulns per app and ~10% portfolio coverage today, and reports ~5 ms request overhead.
AI-written summary · about
chapters (28)
- 0:00Intro
- 5:52Sensor Basketball
- 7:44Application Security
- 8:22Security Spending
- 8:50Security Solutions
- 10:53Traditional Application Security
- 14:21How it works
- 15:39Instrumentation
- 17:59Vulnerability
- 20:50Coral Reef analogy
- 22:09Contrast for Eclipse
- 22:41Demo
- 26:04Trace
- 26:47Eclipse
- 36:46Practical
- 37:01AppSec API
- 39:55Continuous Security
- 40:50Instrumentation Approach
- 41:17Security is a Thing
- 42:31Apple Pay Security Story
- 44:56Defense Strategies
- 47:02Sensor Network
- 49:13Analytics
- 50:09Yelp
- 51:29Security dashboards
- 52:12Penetration testing
- 55:30Assurance
- 56:40Continuous AppSec
related talks
52mApplication Security at DevOps Speed and portfolio scale
52mAppSec at DevOps Speed and Portfolio Scale
28mWhy Developers Struggle with AppSec
30mThe AppSec Error Loop: How We Can Stop Repeating Common Security Mistakes
28mApplication Security: Inside Out
37mHow to get developers to want to adopt AppSec
30mAppSec in a DevOps World
28mHow to Effect Change in the Epistemological Wasteland of App Security