Prioritizing Trust while Creating Applications
summary
Argues for shifting security left by applying tools and practices across the entire lifecycle, with concrete steps: threat modeling and prioritizing security stories, tagging commits, and adding linting in CI/CD (example: an iOS signature-verification bug that linting would have caught). Recommends using platform features like Azure Security Center and scanning dependencies with Have I Been Pwned, running CTFs and red team exercises after a minimum viable response plan exists, and considering paid crowdsourced testing via HackerOne or similar.
AI-written summary · about
chapters (14)
- 0:00Start
- 0:06Jennifer Davis, Cloud Advocate
- 7:31Establish Common Context
- 11:55Build Foundations
- 15:27What can a user see? do? • What information is logged?
- 16:37Threat Modeling
- 17:21Architectural Trade-offs
- 20:25Testing Code
- 21:09Static Code Analysis
- 22:22Coding Standards
- 22:55Secure Code Reviews
- 24:30Incident Response Resource • Building a Minimum Viable Response Plan
- 26:19Leverage your platform's services Recognize your platform's limits
- 27:21Advancing Principles
related talks
38mPrioritizing Trust While Creating Applications
35mPrioritizing Trust while Creating Applications
01h 04mShifting Security Everywhere
40mMaking Security an integrated part of the SW Dev Lifecycle
57mMaking Security Priority Zero
01h 03mBe your own Threatbuster!
26mBuilding and Verifying Security Trust in Today’s Complex Tech Stacks ...
21mIncorporating Security into Platform Engineering: The Dos and Dont’s