10 Things I Wish Every Developer Knew about Security
summary
A list of ten concrete security concepts developers must know, each explained in terms of the associated risk and the correct mitigation; assumes familiarity with OWASP Top 10 and application security programs. Covers practical guidance on how to apply security coaching techniques to help developers adopt those mitigations. Focus is on improving developer understanding so they can secure applications effectively.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:14About Chris Romeo
- 1:48Applicability of the "Ten Things"
- 3:17The goal of an application security program
- 4:50The security state of the developer
- 9:43The easy way out
- 12:20Everyone is a security person and the security need is pervasive.
- 17:43Security is your ally, not your opponent.
- 23:51#3. You cannot hack yourself secure but do take a risk-based approach.
- 27:13OWASP is a treasure trove of security resources.
- 30:29Third-party and open source vulns are rampant.
- 34:17Shift left, right, outwards – just start.
- 35:42The Sec in DevOps is silent.
- 39:27GitHub is not the best secret store.
- 40:53Docker and Kubernetes are not security products.
- 42:11Tactical usage of next generation AppSec.
related talks
54m10 commandments of secure coding
57mThe Developer's Field Guide to Software Security
23mWeb Application Security - owasp top 10 vulnerabilities
48mSecurity Practices for Developers
45mTop 10 That Actually Matter: Web, API, Mobile and LLM
48mWeb Application Security
52mHow to Transform Developers into Security People
40mDevelopers Dislike Security: Ten Frustrations and Resolutions