So long secure coding... Hello secure development!
summary
Argues that code alone is not enough and gives concrete steps: draw a system design and run a threat model (use the Threat Modeling Cookbook, ThreatDragon or the awesome-threat-modeling repo), vet dependencies with a short checklist, and add automated checks like GitHub Actions for trufflehog and semgrep plus Dependabot to catch secrets and common vulnerabilities before commits. Run periodic vulnerability scans (separate pipeline if scans are slow), write one app‑security incident playbook, and prioritize detective controls for legacy systems.
AI-written summary · about
chapters (44)
- 0:00Introduction
- 6:40How do I code securely
- 11:41Design
- 12:24Security Architect
- 13:02Architecture
- 13:44Bear analogy
- 15:28Bear traps
- 16:56Zero trust
- 17:53Controls
- 18:52Threat Modelling Cookbook
- 19:41Threat Modelling Manifesto
- 21:34Homework
- 22:28OS Top 10
- 23:12Anvanka
- 23:22Todays practical
- 23:41Ecosystems
- 25:11GitHub
- 28:05Checklist
- 30:25Dependencies
- 30:54Testing
- 31:49Test Coverage
- 32:57Explore
- 33:30Vulnerability scanning
- 37:23Security testing tools
- 38:47Action for you
- 39:35Deploy
- 40:01Demo
- 40:16Mac
- 41:22Trufflehog
- 42:36GitHub Action
- 43:02Workflows
- 43:41Truffle Hog
- 44:37Vaults
- 45:24Same Graph
- 45:59Precommit hook
- 46:53Scan output
- 47:20GitHub actions
- 48:49Instant response plan
- 49:39Basic instant response plan
- 52:23Team exercise
- 52:57Action
- 53:26Code Centric
- 54:46Find Solutions
- 55:44Questions
related talks
56mSo Long Secure Coding - Practical Steps for Securing the entire SDLC
52mSo Long Secure Coding - Practical Steps for Securing the entire SDLC
45mShifting from Syntax to Secure Software Development Processes
40mMaking Security an integrated part of the SW Dev Lifecycle
01h 03mBe your own Threatbuster!
38mPrioritizing Trust While Creating Applications
52mContinuous Security
01h 04mShifting Security Everywhere