A data driven approach to application security
summary
Equinor builds a low-cost data platform that pulls Snyk and GitHub via nightly GitHub Actions into Postgres (JSONB), visualizes with Apache Superset and lets teams run SQL to answer specific questions. The platform reveals surprises: Dockerfiles supply the largest share of vulnerabilities, they manage ~6,000 repos and ~2,000 active devs from a six-person AppSec team, and a security champion network of ~100 teams (~160 devs) helps outreach. It works for prioritization and trend tracking but still shows false positives, double-counting and metadata gaps that require follow-up.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 2:06Equinor security team
- 3:52External dependencies risks
- 7:28Why scanning fails
- 10:41Querying vulnerability data
- 16:28Need for data platform
- 19:47Low-cost security platform
- 22:20Vulnerability dashboard demo
- 28:46Prioritizing issues
- 33:17Current approach limits
- 35:50Security Champion Network
- 37:58Future data plans
- 41:09Q&A
related talks
30mDevSecOps: How to Level Up IT Security Expertise in Your Organization
52mHow Snowflake uses Snyk to give data-driven analytics for security
36mThe Road To Being Rugged
57mUsing developer-centric data to predict, prioritize, and improve App Security Outcomes
19mFlipping the script on application security
54mFrom App Security to Dev Security – Shift left with GitHub Advanced Security
54mUsing developer-centric data to improve Application Security Outcomes
53mFlipping the Script on Application Security