He Builds a SaaS Solution Without Caring About Security...
summary
A team rushed to build a SaaS platform for collecting football data and reporting with machine learning, then ran penetration tests (black/gray/white-box) that uncovered critical vulnerabilities disrupting development sprints. The talk covers the remediation workflow and hardening using ANSSI and NSA guidance, practical tools like Thuban and Snort, CI security checks, low-value bug bounty implementation (~€50), monitoring/logging setup, and security training via Sec Num Academy.
AI-written summary · about
chapters (17)
- 0:00Conference intro
- 1:13SaaS launch and architecture
- 3:19Penetration testing scenarios
- 6:06Critical vulnerability management
- 8:11Security flaw awareness
- 10:15Penetration testing limits
- 12:24Security hygiene and reviews
- 14:31Zero risk does not exist
- 15:11Intrusion detection and response
- 17:34White-box audits and hardening
- 20:02Integrate security into processes
- 22:12Train teams in security
- 24:18Hands-on hacking practice
- 26:23Bug bounty alternatives
- 28:50Continuous security improvement
- 29:34Good practices summary
- 33:06Conclusion and Q&A
related talks
46mApplication security from start to finish
46mCritical SaaS, Critical Blind Spots: A Detection Engineer's Field Guide to SaaS Attacks
36mThe Road To Being Rugged
36mHow to build continuous security and embed it in your product
33mLearning from Past Security Breaches: Strengthening AppSec Efforts and Focus
33mInterview with
52mContinuous Security
24mWhy security fails, and how we can solve for it