Enterprise Application Risk Profiling
summary
Starts from a single claim: a maintained inventory ranked by actual risk and updated in real time. It defines static / dynamic / real‑time layers, uses Application Security Posture Management (ASM) and SBOM checks, and automates alerts into Slack or CI to catch things like new API without authentication or exposed secret => rotate keys now. Examples include a scored app (27 low, 50 medium, 70 high), pentest-verified findings elevating priority, and automated gating that prevents risky repos reaching master.
AI-written summary · about
chapters (16)
- 0:00Enterprise app risk profiling
- 1:03Why risk profiling matters
- 4:33Building app inventory foundation
- 7:21OWASP SAM risk profiling
- 13:45Every company is software
- 15:32Static vs dynamic risk models
- 18:47Real-time risk visibility with ASM
- 25:36Case study: Bonus app risk scoring
- 29:07Tracking risks beyond apps
- 31:15Cloud migration risks
- 35:50Real-time security monitoring challenges
- 41:07Key takeaways for risk program
- 44:18Q&A: Third-party access risks
- 46:25Q&A: Keeping application inventories up to date
- 48:32Q&A: Prioritizing security alerts
- 52:24Closing remarks
related talks
52mApplication Security at DevOps Speed and portfolio scale
46mJuggling the Elephants: Making AppSec a Continuous Program
20mApplication Security Playbook for Business
50mThe Application Security State of the Union
36mNo Such Thing as a Secure Application
33mBattle Tested Application Security
36mSecuring the software supply chain
55mAh mom, why do I need to eat my vegetables?