Running an Appsec Program with Open Source Projects"

on YouTube ↗08m

" summary

Presents a practical AppSec framework: starts with inventory and requirements, runs threat modeling with the OWASP Threat Modeling Tool (desktop installable), applies secure code review checklists, and enforces software composition analysis to catch vulnerable components like outdated Apache. Adds DAST scans before launch, a central defect store, monitoring and feedback loops, and a shared spreadsheet of recommended OSS projects and contribution paths (code, tests, docs). Notes roughly 40 scholarships used to seed training.

AI-written summary · about

" related talks

• 57mWhat’s in an AppSec program?Claudio Camerino · DevFest Málaga 2019
• 42mBuilding an AppSec Program with a Budget of $0: Beyond the OWASP Top 10Chris Romeo · OWASP AppSec Europe 2018
• 33mJumpstarting Your Appsec ProgramJulia Knecht, Jacob Lords · BSidesSLC 2020
• 49mAppSec, Ready, Set, Go!Yuriy Sergeev · РИТ++ 2017
• 26mOpenSec and Why WebAppSec MattersShah Mijanur Rahman · FOSSASIA Summit 2017
• 46mJuggling the Elephants: Making AppSec a Continuous ProgramTony Miller · AppSec USA 2017
• 59mOpen Application Security Curriculum ProjectAdrian Winckles · OWASP 2022 Global AppSec Europe Virtual Event
• 35mOpen source security: Opportunity or oxymoron?Huzaifa Sidhpurwala · DevConf.CZ 2023