Vulnerabilities that Hide from your Tools
summary
Automation misses whole classes of flaws: business logic errors, misconfigured AWS IAM and security groups, denial of service paths, rogue insiders and secrets tucked into JWTs or config files. Static and dynamic scanners give false negatives — one tool missed passwords because it looked for English names — and developers sometimes use base64 as "encryption" or ECB mode visual leak. Threat modeling uncovers hidden assumptions (found no encryption key), unit tests get created for each bug, and a Lord Varys approach of internal reporters finds issues early.
AI-written summary · about
chapters (26)
- 0:00Introduction
- 0:46About Jillian
- 1:34AppSec Tools
- 4:12Static vs Dynamic Analysis
- 6:20Business Logic
- 7:46Weak or reused passwords
- 9:34Configuration whoopsies
- 10:14Denial of Service
- 11:50Rogue Developers
- 12:29Cryptography Disaster
- 15:28Humans
- 17:24Secrets in Strange Places
- 18:29False Negatives
- 19:38Sensitive Data Exposure
- 20:32Insecure APIs
- 21:49ThirdParty Integration
- 23:03No Naps
- 24:59Lord Varus Approach
- 27:00Threat Modeling
- 28:50Full Circle Development
- 30:12A Pound of Cure
- 30:38Education
- 32:10Default Configurations
- 32:30Background Checks
- 33:08Vet the Spies
- 33:49Questions
related talks
25mThe Voight-Kampff Test for Discovering Vulnerabilities
44mApplication Security: Everything we know is wrong
27mCommon Application Security Mistakes that Enable Automated Attacks
01h 06mEscaping Vulnerability Hell: Bridging the Gap Between Developers and Security Teams
55mBreaking and Fixing Web Application Security
40mAutomated Security: Face Your Vulnerabilities
41mSkillful, Scalefull Fullstack Security in a State of Constant Flux
01h 03m“Secure Coding Best Practices: Your First Line Is The Last Line Of Defense (2 of 2)”