8 Million Findings in One Year: Fresh Look at the State of Software Security
summary
An analysis of 8.3 million software-security findings from over 1 million application scans across tens of thousands of apps, using large-scale data to characterize which types of vulnerabilities and applications are most common and how secure coding practices vary. The presenters use visual analytics to break down patterns in application security findings and draw conclusions about the overall state of software security based on Veracode/Cyentia Institute scan data.
AI-written summary · about
chapters (27)
- 0:00Introduction
- 0:39Veracode State of Software Security Report
- 1:31Why do we do this
- 2:48Highlevel data
- 3:56Median and mean time
- 5:16Compared to 10 years ago
- 8:15High severity flaws
- 8:54Categories of flaws
- 11:25Severity
- 14:39Example
- 16:09Curve
- 17:46Chaos
- 18:58Time to Fix
- 21:08Severity Rating
- 24:08Competition for Budget
- 26:02Fixed Rate
- 27:03Worm Chart
- 30:28Security Debt
- 33:08Security Debt Visualization
- 33:59DevOps
- 34:41Scans
- 37:22Scan Debt
- 37:57Scanning Patterns
- 39:57Bee Swarm
- 41:40Deferring Security
- 42:02Conclusions
- 45:44Questions
related talks
40mNurture vs. Nature in AppSec: Data-Driven Measurement of DevSecOps
01h 00mSecurity Theatre
46mBenchmarking AppSec Across Industries
01h 20mKeynote: BSIMM: A Decade of Software Security
45mSurvey of Notable Web Application Vulnerabilities from the Past Year
53mFlipping the Script on Application Security
50mWorrisome Web Vulnerability Trends in the Race to Innovation
14mThe State of Open Source Vulnerabilities Management in 2019