No Such Thing as a Secure Application
summary
Claims that no app is absolutely secure and that security equals risk management lead to concrete practices: add Brakeman static scans, run bundler-audit on gems, include explicit security tests in CI, and layer dynamic scans plus manual pentests. Implement simple defenses like a tripwire route that logs and can trigger an IP ban via rack-attack. Plan incident response ahead, measure which controls actually block exploits, and treat failures as system gaps to fix rather than personal blame.
AI-written summary · about
chapters (7)
- 0:00Understanding security
- 2:58Defining threat models
- 8:05Risk prioritization
- 12:13Automated security testing
- 21:17Defense in depth
- 22:57Incident detection
- 28:21Building a security culture
related talks
42mSecuring Your Rails App
33mBattle Tested Application Security
43mUncertain Times: Securing Rails Apps and User Data
38mPrioritizing Trust While Creating Applications
53mPractical tips for web application security in the age of agile and DevOps
31mRails Application Security in Practice
20mDefending Against Data Breaches, as a Practicing Ruby Developer
26mHow to Build an Application Security Program