Why you fail at Application Security - and how to fix it
summary
Claims that app security fails because it isn’t scalable, people lack security knowledge, the wrong mindset dominates, and measurement is missing; common fixes are a devsecops culture that shifts responsibility to teams, automation with SAST and DAST plus fuzzing and dependency patching, and education via training and CTFs; an implemented vulnerability management process at one company reduced average fix time to 70 days and fixed critical issues within a week, high within a month, showing those measures actually speed remediation.
AI-written summary · about
chapters (11)
- 0:00Application security challenges
- 1:15Key goals in app security
- 3:49Current security practices
- 5:47Flawed security approaches
- 6:52Major challenges in app security
- 9:01False security measures
- 11:14Fixes for app security
- 13:25DevSecOps transforms security
- 14:07Automation tools for security
- 15:30Education in secure development
- 16:55Conclusion
related talks
27mDevelopers Struggle with Application Security (and How to Make ...)
37mHow to get developers to want to adopt AppSec
31mTopics of Interest: Scaling AppSec through Education
47mSecurity is Everybody's Job
28mWhy Developers Struggle with AppSec
30mThe AppSec Error Loop: How We Can Stop Repeating Common Security Mistakes
45mApplication security loves Agile
26mHow to Build an Application Security Program