As an Attacker, I Want Your Data: Anticipating Security Threats
summary
Shows how an attacker persona is turned into an attacker user story and a concrete failing test, then fixed with Spring Security. Uses Spring Security test support to simulate login, demonstrates one privilege-escalation test that initially returns 200 instead of the expected 403, adds URL-role rules in security config, then reruns the test to get 403. Includes sample code and GitHub link so teams can copy the tests and configs.
AI-written summary · about
chapters (9)
- 0:00Introduction to talk
- 1:07Using personas in development
- 4:12Introducing attacker persona
- 6:03Writing attacker stories
- 7:28Testing security with Spring
- 13:38Summary of security steps
- 14:20Baking attackers into agile
- 17:10Security resources and tips
- 18:13Closing remarks
related talks
44mShift-Left-Security with the Security Test Pyramid
43mTest Driven Application Security
01h 27mHands on Spring Security
33mSpring Security Patterns
24mSecurity – only developers can make it proactive
57mSpring Security for N00bz: A quick introduction for the terminally insecure
57mShift Left Security with the Security Test Pyramid
27mHow to Start Security Testing Without Fear