Defense-in-depth engineering
summary
Covers concrete defenses: start with audit logs 7–14 days and map where sensitive data flows; build Playbooks and log-driven self-service for customers; write focused tests (unit-first, permutation harnesses) to catch command injection and XSS and prevent regressions; mitigate SQL injection with allowlist table names plus setting instance variables so removals break safely; roll out per-page Content Security Policy and avoid naive sanitizers—noting DomPurify allows 110 tags and led to a major client-side DOM XSS bounty.
AI-written summary · about
chapters (10)
- 0:00Defense-in-depth intro
- 5:19What is defense in depth
- 6:43Incident response design
- 13:55Self-service audit logging
- 19:10Regression prevention with RCA
- 21:18Effective security tests
- 31:45SQL injection defenses
- 39:59Security headers defense
- 48:04XSS and output encoding
- 59:44Client-side vulnerability investigation
related talks
01h 03m"Defense in depth": trench warfare principles
29mGraphQL Security Best Practices and Hardening
52mContinuous Security
47mD2T2 - Defense-in-Depth Techniques for Modern Web Apps
30mWeb Security Engineering - Protect all layers of your project
34mPurple Team Strategies for Application Security
49mLessons from DevSecOps Trenches
33mLearning from Past Security Breaches: Strengthening AppSec Efforts and Focus