The Tactical Application Security Program: Getting Stuff Done
summary
A lightweight team runs an intake->execute->deliver pipeline that completes 400+ assessments a year, with an on-call pentester triaging reports under a 4-hour triage SLA and office hours twice weekly; incident examples include a profile-picture and a SlideShare YouTube flaw patched via an upstream block and hot fix in hours. A private program pays researchers (>$85k) and prioritizes a curated private bug bounty roster to cut noise and speed remediation.
AI-written summary · about
chapters (37)
- 0:00Introduction
- 3:16Tactical Approach
- 3:50Lightweight
- 5:47Agile
- 7:00Operational Excellence
- 7:54Code Yellow
- 9:25Authority Buyin
- 11:47Application Assessments
- 17:07Office Hours
- 18:29Service Catalog
- 19:15Product Review
- 20:50Internal Assessments
- 22:37Assessment Pitfalls
- 23:54Missing the Big Picture
- 25:03Application Incident Response
- 25:22Critical Bugs
- 26:11Handling Incoming Reports
- 27:45Case Study Changing Faces
- 29:06Bug Reporting
- 30:41Push Code Fast
- 31:45Cleanup
- 32:59Taste Study
- 35:31What We Found
- 35:46Bug Severity Table
- 36:13Communication
- 37:33Example Email
- 39:20Setting Expectations
- 39:51Collaboration
- 40:49Bug Bounty Programs
- 41:32Case Study
- 43:28How did we get to our program
- 44:23Our private bug bounty program
- 46:21Signaltonoise ratio
- 46:39Impact on business
- 47:48Signal to noise ratio
- 48:35Key takeaways
- 53:20Technology
related talks
45mRunning an efficient bug bounty program and PSIRT... (Garrett McNamara, Jeff Guerra)
43mThe Art of Vulnerability Management - Practical Application of Cyber Triage
41mAim-Ready-Fire
33mBattle Tested Application Security
33mRapid-Fire Stories of Creative Solutions to InfoSec Problems
48mAppSec++ Take the best of Agile, DevOps and CI/CD into your AppSec Program
57mWhat’s in an AppSec program?
51mTaking AppSec to 11: Pipelines, DevOps and making things better