From the archive
Specific recommendations, grounded in the original conversation. Start with what’s newest or choose one lens.
Choose one filter
Showing the four newest recommendations
Said by Speaker not identified ·
“Think about when you are doing that, how much of context is going outside of the actual system.”
Transcript evidence from Shadow MCP Servers: The AI Security Risk Hiding on Your Developers' Laptops.
Said by Chris Romeo ·
“We need to identify, like, from an MCP perspective, deleting everything out of an account should fire a consent to me.”
Transcript evidence from Shadow MCP Servers: The AI Security Risk Hiding on Your Developers' Laptops.
Said by Chris Romeo ·
“What's the template that we should use for a secure MCP server?”
Transcript evidence from Shadow MCP Servers: The AI Security Risk Hiding on Your Developers' Laptops.
Said by Speaker not identified ·
“At the same time, we need to make sure that as an AppSec person, we give a paved road to the developers.”
Transcript evidence from Shadow MCP Servers: The AI Security Risk Hiding on Your Developers' Laptops.
Said by Speaker not identified ·
“Don't treat MCT server as like any other server.”
Transcript evidence from Shadow MCP Servers: The AI Security Risk Hiding on Your Developers' Laptops.
Said by Brook S.E. Schoenfield ·
“If your inexperienced threat modelers find one thing and they do something about it, you're in better shape than you were yesterday.”
Transcript evidence from Your Opinion on AI Doesn't Matter. Learned Fragility Does.
Said by Brook S.E. Schoenfield ·
“But wherever you have greater needs, it is not wrong to get an expert in there to finish the job.”
Transcript evidence from Your Opinion on AI Doesn't Matter. Learned Fragility Does.
Said by Brook S.E. Schoenfield ·
“For one thing, even the slightest little twiddle away from goals, set goals, and these things, they drift. There's provable drift.”
Transcript evidence from Your Opinion on AI Doesn't Matter. Learned Fragility Does.
Said by Brook S.E. Schoenfield ·
“I'm going to ask it to go read the repos. and make a good graph and give me a reachability so that whenever I don't have to do the work, whenever I find a weakness, I can ask it from the code, how reachable is this guy?”
Transcript evidence from Your Opinion on AI Doesn't Matter. Learned Fragility Does.
Said by Brook S.E. Schoenfield ·
“Why not fix as much as you possibly can with agents knowing that some of it will be dreck and some of it will be wrong, and you catch it through the next and keep fixing?”
Transcript evidence from Your Opinion on AI Doesn't Matter. Learned Fragility Does.
Said by Jim Manico ·
“Focus on the technical, the experience, the practice, the technical guides, and learn the technology first, then go complain about it, right?”
Transcript evidence from Why AI Code Review Will Replace Human Review Faster Than You Think.
Said by Jim Manico ·
“By the way, before I do this, I would review the architecture by hand with the architect of that project. I'll review the security rules with the security lead of the project.”
Transcript evidence from Why AI Code Review Will Replace Human Review Faster Than You Think.
Said by Jim Manico ·
“I think agentic review and using SAST and using SCA and using traditional AppSec tools, And unit testing.”
Transcript evidence from Why AI Code Review Will Replace Human Review Faster Than You Think.
Said by Jim Manico ·
“An agent is trying to review a PR it doesn't have access to, freeze it, get a human involved.”
Transcript evidence from Why AI Code Review Will Replace Human Review Faster Than You Think.
Said by Jim Manico ·
“Teach your developers when they're doing complicated things, to ask AI not to write code, but to build them a plan to write code so they can review what's about to happen before it happens.”
Transcript evidence from Why AI Code Review Will Replace Human Review Faster Than You Think.
Said by Jeevan Singh ·
“We have to start saying, no, these are the lines in the sand that you cannot cross at all, and building our programs that way so that they know that this is the line that they can't cross, but they can self-help themselves to get to the place that they need to be without crossing that line.”
Transcript evidence from Vulnerability Jail and the AI-Era AppSec Engineer.
Said by Jeevan Singh ·
“We had Vulnerability Jail already, but now we're going to be changing SLAs to 3, 5, 7, and 10.”
Transcript evidence from Vulnerability Jail and the AI-Era AppSec Engineer.
Said by Jeevan Singh ·
“Be an engineer, embrace AI, be obsessive about it, read everything, practice on your time off, do whatever you need to do, build build”
Transcript evidence from Vulnerability Jail and the AI-Era AppSec Engineer.
Said by Petra Vukmirovic ·
“You need to make sure you give it the right information in the right structure with the right constraints and the right guidelines.”
Transcript evidence from How Agentic AI Fails—and Which Controls Actually Stop It.
Said by Petra Vukmirovic ·
“All of these things, if they can be true at, they have to be true at once, then usually you have to think about, okay, well, is there a trigger?”
Transcript evidence from How Agentic AI Fails—and Which Controls Actually Stop It.
Said by Petra Vukmirovic ·
“Use any helpers that you can get from AI, industry information, logs.”
Transcript evidence from How Agentic AI Fails—and Which Controls Actually Stop It.
Said by Chris Romeo ·
“After that happened, I put in an opt-in that went to the champion and their manager, and they both had to agree on a yearly basis that this is okay.”
Transcript evidence from Your AppSec Bottleneck Is a People Problem.
Said by Lisi Hocke ·
“We can make things smaller, go smaller steps.”
Transcript evidence from Your AppSec Bottleneck Is a People Problem.
Said by Lisi Hocke ·
“Our proposal here is to build a champions community so that we're not overly relying on like a central security team, which is probably like a lot less people.”
Transcript evidence from Your AppSec Bottleneck Is a People Problem.
Said by Lisi Hocke ·
“Now what we have as a working agreement is we don't even record meetings because to set the ground for people being free to speak up and not fear that recording gets out of hand and somehow someone else, their manager, finds it and then they get the retribution.”
Transcript evidence from Your AppSec Bottleneck Is a People Problem.
Said by James Berthoty ·
“I do think there is still like a strength to being like an AI-native, either AI SaaS company or AI pen testing company, because you 've built so much harness and IP around like deduplication of results, how to build like a pipeline to go and do these things, how to do false positive analysis,”
Transcript evidence from AI Pen Testing Killed Traditional DAST.
Said by James Berthoty ·
“First of all, vendors will always choose the pricing structure that maximizes the cost.”
Transcript evidence from AI Pen Testing Killed Traditional DAST.
Said by James Berthoty ·
“They could build what this, any of the CNAPP providers and provide all of those CNAPP capabilities natively within their platform.”
Transcript evidence from AI Pen Testing Killed Traditional DAST.
Said by Rob van der Veer ·
“When you come up with an idea, you need to do an impact assessment and talk about, okay, who's going to be personally affected? What can be the risks? How can we protect against that? Are there any relevant regulations that we need to look into?”
Transcript evidence from AI Security: OWASP Meets Global Standards.
Said by Rob van der Veer ·
“If you use LLMs in red teaming, that includes a white box approach, that includes code, you will find the big leap will be in finding vulnerabilities that are hidden and found by looking at the code.”
Transcript evidence from AI Security: OWASP Meets Global Standards.
Said by Rob van der Veer ·
“Red teams need to think about sequences of events, cunning sequences that can lead to harm and that circumvent certain protections.”
Transcript evidence from AI Security: OWASP Meets Global Standards.
Said by Rob van der Veer ·
“We need to be clear about setting these boundaries”
Transcript evidence from AI Security: OWASP Meets Global Standards.
Said by Rob van der Veer ·
“We need to plan breaks. Real breaks from this.”
Transcript evidence from AI Security: OWASP Meets Global Standards.
Said by Vikramaditya Narayan ·
“You get a very plausible sounding threat model.”
Transcript evidence from The Future of Open-Source Threat Modeling.
Said by Vikramaditya Narayan ·
“You throw in a data flow diagram, a sequence diagram”
Transcript evidence from The Future of Open-Source Threat Modeling.
Said by Vikramaditya Narayan ·
“I could build this and create a tool that would be open source.”
Transcript evidence from The Future of Open-Source Threat Modeling.
Said by Isaac Evans ·
“I'm going to suggest that this rule be promoted to the code generation loop across the entire org.”
Transcript evidence from Isaac Evans - AppSec in the Age of AI.
Said by Isaac Evans ·
“I think the security engineer becomes the same thing, right? Like, hey, like, I'm going to manage a fleet of virtual security agents. They're going to do most of the toil work, right?”
Transcript evidence from Isaac Evans - AppSec in the Age of AI.
Said by Isaac Evans ·
“I think that the advice to optimize for agility when it comes to security knowledge is important, right? Like you want to be on top of like, well, what is the latest trend here? Like what's going on? Like who are the security teams that have figured out how to get some good leverage in this new era and what are they doing? So I think that the importance of socializing with the security community, going to conferences, understanding how the teams that are effectively leveraging virtual agents is greater and greater.”
Transcript evidence from Isaac Evans - AppSec in the Age of AI.
Said by Isaac Evans ·
“Then my second piece of advice is, be hands-on with the technology. Like there's never been a better time to be an IC, and the leverage that you can get as a solo IC is insane.”
Transcript evidence from Isaac Evans - AppSec in the Age of AI.
Said by Isaac Evans ·
“What we've talked about so far is, hey, like if we provide plugins to the models that essentially are like additional security tests, I think you can start to get some good properties that are like, okay, like, we can trust that The model did not generate code that had any SQL injection possibilities.”
Transcript evidence from Isaac Evans - AppSec in the Age of AI.
Said by José Carlos Chávez ·
“Because one of the main goals of observability is to be able to react. And then to react, you need to make sense out of the data, right? And then convert this data into information and that information into action.”
Transcript evidence from José Carlos Chávez - When Museums Get Hacked: OWASP Top 10 Lessons from Heists.
Said by José Carlos Chávez ·
“You have to implement the controls, but then monitor Um, how is it working? Like how many denials did you have? How many, um, permission grants did you have? And then what is the baseline? What are the deviations? who are the outliers?”
Transcript evidence from José Carlos Chávez - When Museums Get Hacked: OWASP Top 10 Lessons from Heists.
Said by José Carlos Chávez ·
“Things, easy things like Dockerfiles, you might see Dockerfiles, plenty of Wget or curl where they are pulling down artifacts directly from GitHub host. And then with no integrity check, no checksum, Nothing, curl and then directly execute the bash script or unzipping the content and then dumping into the Dockerfile, into the Docker image.”
Transcript evidence from José Carlos Chávez - When Museums Get Hacked: OWASP Top 10 Lessons from Heists.
Said by José Carlos Chávez ·
“For that, you need to take the same warranties as you will do with any database, for example, like encryption at transport, encryption at rest, and then permissions for writing, or even better, like immutability.”
Transcript evidence from José Carlos Chávez - When Museums Get Hacked: OWASP Top 10 Lessons from Heists.
Said by José Carlos Chávez ·
“Security needs you. And ownership or security, for security being a thing, for security being effective, for security being tangible and possible to roll out across an organization, you need a strong sense of ownership.”
Transcript evidence from José Carlos Chávez - When Museums Get Hacked: OWASP Top 10 Lessons from Heists.
Said by Michael Burch ·
“We have to make sure what we want to do aligns with the business case.”
Transcript evidence from Michael Burch - AI-Enabled Citizen Developers.
Said by Michael Burch ·
“We need to find security guardrails and workflows that align to the work being done, not what we want people to do.”
Transcript evidence from Michael Burch - AI-Enabled Citizen Developers.
Said by Michael Burch ·
“Don't push big things, push small things quickly, and that way everyone can understand what's happening”
Transcript evidence from Michael Burch - AI-Enabled Citizen Developers.
Said by Josh Grossman ·
“But that means you have to keep an eye on certain things and make sure that it's not gonna end up doing things that you don't wanna do, or pushing code you don't wanna do, or suddenly changing major settings.”
Transcript evidence from Josh Grossman--AI & SAST: Is it a match?.
Said by Josh Grossman ·
“If you want to do the static discovery, you have to make sure the static discovery is going to be compatible with your, with the tool you're using to discover.”
Transcript evidence from Josh Grossman--AI & SAST: Is it a match?.
Said by Josh Grossman ·
“You have to ask Claude to build you an emulator for it.”
Transcript evidence from Josh Grossman--AI & SAST: Is it a match?.
Said by Dwayne McDaniel ·
“There's a false sense of security that I'm doing this internally.”
Transcript evidence from Dwayne McDaniel -- Secrets Sprawl and How AI is Impacting Secrets.
Said by Dwayne McDaniel ·
“You're being nice, but you're doing it inside of Jira.”
Transcript evidence from Dwayne McDaniel -- Secrets Sprawl and How AI is Impacting Secrets.
Said by Dwayne McDaniel ·
“If you have standing privilege for any entity, that's bad, but that's not a new concept.”
Transcript evidence from Dwayne McDaniel -- Secrets Sprawl and How AI is Impacting Secrets.
Said by Chris Romeo ·
“You should treat AI like a junior developer.”
Transcript evidence from Tanya Janca - Secure Vibe Coding.
Said by Tanya Janca ·
“These are the security requirements that I have every single time that I would want to start with.”
Transcript evidence from Tanya Janca - Secure Vibe Coding.
Said by Tanya Janca ·
“Because I remember when I first used Burp Suite the first time, I took down production”
Transcript evidence from Tanya Janca - Secure Vibe Coding.
Said by Caroline Wong ·
“If attackers are using AI, defenders can use AI.”
Transcript evidence from Caroline Wong--The AI Cybersecurity Handbook.
Said by Caroline Wong ·
“Build agents that both ensure that those patterns are in use everywhere they're supposed to be, as well as finds areas where it's different and fixes it.”
Transcript evidence from Caroline Wong--The AI Cybersecurity Handbook.
Said by Caroline Wong ·
“Our ability to ruthlessly prioritize and do proper risk management becomes incredibly important.”
Transcript evidence from Caroline Wong--The AI Cybersecurity Handbook.
Said by Caroline Wong ·
“We need explainability and we need transparency.”
Transcript evidence from Caroline Wong--The AI Cybersecurity Handbook.
Said by Chris Romeo ·
“Learn how AI works under the hood.”
Transcript evidence from Caroline Wong--The AI Cybersecurity Handbook.
Said by Steve Wilson ·
“You want to wall it off somewhere where you get a little control over it.”
Transcript evidence from Steve Wilson--OpenClaw and Advanced AI Agents.
Said by Steve Wilson ·
“You need to treat this as a runtime insider threat problem.”
Transcript evidence from Steve Wilson--OpenClaw and Advanced AI Agents.
Said by Steve Wilson ·
“I probably need, 2 people and one of them should be a human before some of those actions are allowable”
Transcript evidence from Steve Wilson--OpenClaw and Advanced AI Agents.
Said by Steve Wilson ·
“It's mandatory to extend your insider threat program to handle AI agents in addition to humans.”
Transcript evidence from Steve Wilson--OpenClaw and Advanced AI Agents.
Said by Steve Wilson ·
“You need to be analyzing the behavior all the time.”
Transcript evidence from Steve Wilson--OpenClaw and Advanced AI Agents.
Said by Brad Geesaman ·
“To your point, AI to get funding, but I think that there's reality, there's quality within the hype that gets drowned out.”
Transcript evidence from Brad Geesaman - Redefining AppSec with AI: Shrinking Toil, Expanding Impact - How LLMs are able to reduce toil in triage-heavy AppSec workflows.
Said by Brad Geesaman ·
“For you to trust the finding, you have to validate it so that you can broker your trust to the devs and not look like a silly fool when they go, hey, that's not an issue.”
Transcript evidence from Brad Geesaman - Redefining AppSec with AI: Shrinking Toil, Expanding Impact - How LLMs are able to reduce toil in triage-heavy AppSec workflows.
Said by Brad Geesaman ·
“There's a middleware library, or there's another capability, or there's something that is unique to your coding style that you can have a conversation with the developers and say, folks, we have 50 BOLAs.”
Transcript evidence from Brad Geesaman - Redefining AppSec with AI: Shrinking Toil, Expanding Impact - How LLMs are able to reduce toil in triage-heavy AppSec workflows.
Said by Chris Romeo ·
“If you are an OWASP member, get out and vote.”
Transcript evidence from OWASP Candidate Debate - 2025 Edition.
Said by Chris Romeo ·
“Bringing OWASP into education”
Transcript evidence from OWASP Candidate Debate - 2025 Edition.
Said by Chris Romeo ·
“Chapters need support”
Transcript evidence from OWASP Candidate Debate - 2025 Edition.
Said by Chris Romeo ·
“Local chapters need to embed with their local community the educational support.”
Transcript evidence from OWASP Candidate Debate - 2025 Edition.
Said by Chris Romeo ·
“How do you measure the progress of the foundation in achieving those things?”
Transcript evidence from OWASP Candidate Debate - 2025 Edition.
Said by Francesco Cipollone ·
“I think we need to train the next generation of developers to use this technology securely rather than saying you're never going to have a job or you're going to be replaced.”
Transcript evidence from Francesco Cipollone - Agentic AI Manifesto.
Said by Francesco Cipollone ·
“We need to embrace and adopt this technology and understand how to use it and how to 10x people.”
Transcript evidence from Francesco Cipollone - Agentic AI Manifesto.
Said by Francesco Cipollone ·
“You need to think about how are you gonna charge and how are you gonna recuperate that money because you're gonna run out of cash very quickly.”
Transcript evidence from Francesco Cipollone - Agentic AI Manifesto.
Said by Francesco Cipollone ·
“But there are problems that should not be solved by agents or are very expensive If sold by agent.”
Transcript evidence from Francesco Cipollone - Agentic AI Manifesto.
Said by Francesco Cipollone ·
“Use technology as a tool, otherwise you'll become the tool.”
Transcript evidence from Francesco Cipollone - Agentic AI Manifesto.
Said by Chris Romeo ·
“Now, through their sister brand, CyberSec Games, they're helping thousands of people learn threat modeling and security concepts through engaging, hands-on gameplay.”
Transcript evidence from Simon Gibbs & Devika Gibbs -- Building Bridges with Games.
Said by Speaker not identified ·
“But if you threat model a real system with OWASP Cornucopia, you'll learn stuff about a real system that you can go ahead and use.”
Transcript evidence from Simon Gibbs & Devika Gibbs -- Building Bridges with Games.
Said by Chris Romeo ·
“It's not necessarily how you want to be doing it at scale with 10,000 people, but it's a great way to introduce the idea, to learn it.”
Transcript evidence from Simon Gibbs & Devika Gibbs -- Building Bridges with Games.
Said by Akansha Shukla ·
“For every known vulnerability, they do have a cheat sheet which can be easily referred.”
Transcript evidence from Akansha Shukla - Modern AppSec: Securing APIs with Threat Modeling and DevSecOps.
Said by Akansha Shukla ·
“I think it will sort a lot of problems if we can have one standardized solution for all these authorization.”
Transcript evidence from Akansha Shukla - Modern AppSec: Securing APIs with Threat Modeling and DevSecOps.
Said by Akansha Shukla ·
“When you are doing threat modeling, take consider, like do consider these APIs and their flow, their business logic.”
Transcript evidence from Akansha Shukla - Modern AppSec: Securing APIs with Threat Modeling and DevSecOps.
Said by Akansha Shukla ·
“It helps you that what all APIs you have in your organization, like depending on the classification, specification, functionality, all these will help.”
Transcript evidence from Akansha Shukla - Modern AppSec: Securing APIs with Threat Modeling and DevSecOps.
Said by Akansha Shukla ·
“When you start developing or when you start thinking about developing something, you should think about security.”
Transcript evidence from Akansha Shukla - Modern AppSec: Securing APIs with Threat Modeling and DevSecOps.
Said by Robert Hurlbut ·
“They try to break our code and I try to like make it work with any input possible, whatever way you try to abuse it.”
Transcript evidence from Getting Ready for the EU CRA.
Said by Robert Hurlbut ·
“I would like test very thoroughly everything.”
Transcript evidence from Getting Ready for the EU CRA.
Said by Robert Hurlbut ·
“BSIM is a maturity framework with like 110, 115 different questions you ask to development teams and you try to find the gaps and what's missing and you plan some improvement.”
Transcript evidence from Getting Ready for the EU CRA.
Said by Robert Hurlbut ·
“They have 90 activities that you could do, and it gives you this way to measure yourself internally and plan properly the small steps.”
Transcript evidence from Getting Ready for the EU CRA.
Said by Robert Hurlbut ·
“Then within the 7 days, you have to give an update, like exactly what happened and what did you do about it.”
Transcript evidence from Getting Ready for the EU CRA.
Said by Marisa Fagan ·
“Make it something that people can be motivated by proactively because they have seen it and they understand, oh, if I do this, then this will happen.”
Transcript evidence from Marisa Fagan - Measuring Security Culture.
Said by Marisa Fagan ·
“I don't think you need to get your security champions program ratified by legal, but the mindset that it should be a trustworthy agreement between 2 sides resonates.”
Transcript evidence from Marisa Fagan - Measuring Security Culture.
Said by Marisa Fagan ·
“If you can tell the story that teams that have champions show faster participation in our vulnerability management process, that is a great story to tell that comes from a metric that you need to start tracking first.”
Transcript evidence from Marisa Fagan - Measuring Security Culture.
Said by Aram Hovsepyan ·
“You should start with your goals and we start with goals because Every organization is unique.”
Transcript evidence from Aram Hovsepyan -- Your Security Dashboard is Lying to You: The Science of Metrics.
Said by Aram Hovsepyan ·
“Then once we have these goals, the next level is formulating questions to measure progress towards that goal, to measure, to see how well we are doing in terms of a specific goal and to measure the progress towards that goal. And only then we pick metrics to answer these questions in a quantitative way.”
Transcript evidence from Aram Hovsepyan -- Your Security Dashboard is Lying to You: The Science of Metrics.
Said by Aram Hovsepyan ·
“When you pick your metrics, you will eventually be facing the questions of how reliable is this metric, how precise is this metric, and what is the validity of this metric when we want to go back and answer the question that to support this is a certain decision-making, which comes from the goal.”
Transcript evidence from Aram Hovsepyan -- Your Security Dashboard is Lying to You: The Science of Metrics.
Said by Aram Hovsepyan ·
“You could go a step further and ask teams to write unit and integration tests for those requirements, which are then automated in your CI/CD pipelines.”
Transcript evidence from Aram Hovsepyan -- Your Security Dashboard is Lying to You: The Science of Metrics.
Said by Aram Hovsepyan ·
“Your dashboard should reveal the truth of what's going on in terms, in terms of your process perhaps, rather than your output and these scanners that look into your code, because that's one side of the story. And a typical AppSec program is about people, processes, and tools.”
Transcript evidence from Aram Hovsepyan -- Your Security Dashboard is Lying to You: The Science of Metrics.
Said by Sean Varga ·
“It's important to be very detail-oriented when you're talking to your customers in application security”
Transcript evidence from Sean Varga -- OWASP Top 10 for AppSec Sales.
Said by Sean Varga ·
“Get these few customers that you first land, get them successful, listen to them intently”
Transcript evidence from Sean Varga -- OWASP Top 10 for AppSec Sales.
Said by Sean Varga ·
“You have to write these things down”
Transcript evidence from Sean Varga -- OWASP Top 10 for AppSec Sales.
Said by Sarah-jane Madden ·
“The same thing will happen with your ability to interpret code.”
Transcript evidence from Sarah-Jane Madden -- What AI means for AppSec.
Said by Sarah-jane Madden ·
“You need to be fairly strict on what tools can and can't be used.”
Transcript evidence from Sarah-Jane Madden -- What AI means for AppSec.
Said by Sarah-jane Madden ·
“Um, but we've, we do need to use it responsibly and thoughtfully.”
Transcript evidence from Sarah-Jane Madden -- What AI means for AppSec.
Said by Dag Flachet ·
“Even if you have only 15 minutes, if you keep it into like a systematic small steps of improvements, but keep track that everything else isn't drifting away.”
Transcript evidence from Dag Flachet -- Kaizen for your Appsec Program.
Said by Dag Flachet ·
“That's why a maturity model like OWASP SAM is good because it keeps track of everything, the state of everything, and then you try to move the lever somewhere a little bit.”
Transcript evidence from Dag Flachet -- Kaizen for your Appsec Program.
Said by Dag Flachet ·
“Don't be afraid of little steps as long as you have the map well laid out and the little steps may seem Quite insignificant in the big picture, but if you're consistent with little steps, you can have pristine quality and security on the long run.”
Transcript evidence from Dag Flachet -- Kaizen for your Appsec Program.
Said by Chris Romeo ·
“There needs to be something new because you need to separate the prompt, the command from the input and have some type of a solution that lets you, the im— that lets the model treat the input as only input and never commands that could cause it to go in a different route.”
Transcript evidence from Javan Rasokat and Andra Lezza -- When Chatbots Go Rogue - Lessons Learned from Building and Defending LLM Applications.
Said by Speaker not identified ·
“It's not like that we have to run another model, but it's, this would be the second layer, which we did on the, which Andra was describing.”
Transcript evidence from Javan Rasokat and Andra Lezza -- When Chatbots Go Rogue - Lessons Learned from Building and Defending LLM Applications.
Said by Speaker not identified ·
“If your, if your company policy tells you to not share sensitive company information with ChatGPT, then you should listen to that, especially if you work in a government intelligence agency.”
Transcript evidence from Javan Rasokat and Andra Lezza -- When Chatbots Go Rogue - Lessons Learned from Building and Defending LLM Applications.
Said by Speaker not identified ·
“We need to build awareness and knowledge about those type of attacks because as you can't do a good threat model if you don't know those type of attacks.”
Transcript evidence from Javan Rasokat and Andra Lezza -- When Chatbots Go Rogue - Lessons Learned from Building and Defending LLM Applications.
Said by Speaker not identified ·
“Um, mine isn't gonna be very interesting, but I'd say use AI wisely.”
Transcript evidence from Javan Rasokat and Andra Lezza -- When Chatbots Go Rogue - Lessons Learned from Building and Defending LLM Applications.
Said by Robert Hurlbut ·
“Identifying what your fulfillment is from different types of work activities is probably paramount.”
Transcript evidence from Jim Routh -- The CISO Transition to the rest of life.
Said by Robert Hurlbut ·
“Start with a not-for-profit because they're always looking for board members”
Transcript evidence from Jim Routh -- The CISO Transition to the rest of life.
Said by Robert Hurlbut ·
“If you're going to do your own type of work and have flexibility, you're going to create an LLC to protect your liability.”
Transcript evidence from Jim Routh -- The CISO Transition to the rest of life.
Said by Jim Routh ·
“What 2 skills do I want to invest my time in learning and/or mastering”
Transcript evidence from Jim Routh -- The CISO Transition to the rest of life.
Said by Jim Routh ·
“Use as a criteria for deciding when it's time to change your job.”
Transcript evidence from Jim Routh -- The CISO Transition to the rest of life.
Said by Henrik Plate ·
“Observe the maintenance level or the maintenance status of all your upstream projects.”
Transcript evidence from Henrik Plate -- OWASP Top 10 Open Source Risks.
Said by Henrik Plate ·
“Every development organization should read through those lists and shape their own AppSec program around it”
Transcript evidence from Henrik Plate -- OWASP Top 10 Open Source Risks.
Said by Henrik Plate ·
“Learning about new advisories, monitoring the corresponding feeds, and then assessing the relevancy in your application.”
Transcript evidence from Henrik Plate -- OWASP Top 10 Open Source Risks.
Said by Henrik Plate ·
“Check what are your important requirements and are those met by the different tool vendors?”
Transcript evidence from Henrik Plate -- OWASP Top 10 Open Source Risks.
Said by Henrik Plate ·
“Pinning a certain version or opposed to even better, a certain commit”
Transcript evidence from Henrik Plate -- OWASP Top 10 Open Source Risks.
Said by Tanya Janca ·
“In AppSec we need to understand other people”
Transcript evidence from Tanya Janca -- A Secure SDLC from a Developer's Perspective.
Said by Chris Romeo ·
“We need to go out to developer conferences.”
Transcript evidence from Tanya Janca -- A Secure SDLC from a Developer's Perspective.
Said by Chris Romeo ·
“We need to go back to the, to the whiteboard and start fresh”
Transcript evidence from Tanya Janca -- A Secure SDLC from a Developer's Perspective.
Said by Mehran Koushkebaghi ·
“If you're dealing like a 3-tier web application in some environment, it's going to be having a completely different completely different resilience and security requirement if you change that environment.”
Transcript evidence from Mehran Koushkebaghi -- Security as a Systemic Concern: How to develop Anti-Requirements.
Said by Mehran Koushkebaghi ·
“Most often the data flow is not quite well understood when you're talking to the people that would like to secure the system.”
Transcript evidence from Mehran Koushkebaghi -- Security as a Systemic Concern: How to develop Anti-Requirements.
Said by Mehran Koushkebaghi ·
“We are not getting resiliency from a collection of resilient components.”
Transcript evidence from Mehran Koushkebaghi -- Security as a Systemic Concern: How to develop Anti-Requirements.
Said by Mehran Koushkebaghi ·
“The assumption that user will adapt to use the system in a way that it is designed for, is often not true.”
Transcript evidence from Mehran Koushkebaghi -- Security as a Systemic Concern: How to develop Anti-Requirements.
Said by Mehran Koushkebaghi ·
“Whether you need the input validation Depends on the the nature of application that you're building, how you define the trust boundaries, where the data is coming from.”
Transcript evidence from Mehran Koushkebaghi -- Security as a Systemic Concern: How to develop Anti-Requirements.
Said by Kalyani Pawar ·
“Once you've hit that mark, that's when you should get a specific AppSec person to take care of this.”
Transcript evidence from Kalyani Pawar -- Shaping AppSec at Startups.
Said by Kalyani Pawar ·
“If in terms of, say, if I can say in a finance software, if I was able to say that if we were able to push this feature, we're gonna print out all the SSNs, I don't think anybody wants that, right? I think at that point, people are willing to work with you on this.”
Transcript evidence from Kalyani Pawar -- Shaping AppSec at Startups.
Said by Kalyani Pawar ·
“Adding these bottlenecks or gates at the right, in the right workflows through the right processes, that definitely helps with scaling.”
Transcript evidence from Kalyani Pawar -- Shaping AppSec at Startups.
Said by Kalyani Pawar ·
“First of all, you cannot secure what you cannot see. So, try to see everything that you have. Try talking to as many, say, if it was my day one at a certain startup as an AppSec engineer, my first line of action would be to talk to all the developers and ask them about an architecture diagram for whatever has been built.”
Transcript evidence from Kalyani Pawar -- Shaping AppSec at Startups.
Said by Kalyani Pawar ·
“When we're talking about third-party tools, we often overlook the aspect of vendor security when I feel like every time we onboard new tools, there has to be some security vetting process in place.”
Transcript evidence from Kalyani Pawar -- Shaping AppSec at Startups.
Said by Milan Williams ·
“Metrics are a great way to make sure you feel like you're making progress, quarter over quarter, month over month.”
Transcript evidence from Milan Williams -- AppSec Metrics.
Said by Milan Williams ·
“It's all about being able to tell that story.”
Transcript evidence from Milan Williams -- AppSec Metrics.
Said by Milan Williams ·
“One set of metrics that are what I call pulse metrics, which focus on things that are happening now”
Transcript evidence from Milan Williams -- AppSec Metrics.
Said by Milan Williams ·
“Tracking your vulnerability backlog, like how many things are in production, right now”
Transcript evidence from Milan Williams -- AppSec Metrics.
Said by Milan Williams ·
“We're trying to solve this problem together”
Transcript evidence from Milan Williams -- AppSec Metrics.
Said by MO Sadek ·
“If we were going to ask people to do things for us, we should understand what the real roadblocks and challenges that they had were.”
Transcript evidence from MO Sadek -- Building an AppSec Program from Scratch.
Said by MO Sadek ·
“Security is everybody's job, so you should be speaking everybody's language when you're doing it.”
Transcript evidence from MO Sadek -- Building an AppSec Program from Scratch.
Said by MO Sadek ·
“You need to find some way to get visibility into what all the engineers are working on, or at least some of the risks that the organization face.”
Transcript evidence from MO Sadek -- Building an AppSec Program from Scratch.
Said by Brett Crawley ·
“To update the diagram or the model with the new threats for the new developments that you're planning, because it should be done before you implement, ideally, so that you can correct the design before you start implementing.”
Transcript evidence from Brett Crawley -- Threat Modeling Gameplay with EoP.
Said by Brett Crawley ·
“You need to, the people involved need to have a good understanding of the system that they're developing.”
Transcript evidence from Brett Crawley -- Threat Modeling Gameplay with EoP.
Said by Brett Crawley ·
“I took those and I put those into the board, and then I added Post-its for pink ones for the threats, orange ones for proposed mitigations, and green ones for mitigations that are already existing in the design or in the implementation.”
Transcript evidence from Brett Crawley -- Threat Modeling Gameplay with EoP.
Said by Matin Mavaddat ·
“If we think of security as a non-functional quality of the system, it means that it's holistic”
Transcript evidence from Matin Mavaddat - Understanding Security as a Systemic Concern: The Role of Anti-Requirements.
Said by Matin Mavaddat ·
“You need to understand fully what the context is, what the objectives of your system is”
Transcript evidence from Matin Mavaddat - Understanding Security as a Systemic Concern: The Role of Anti-Requirements.
Said by Matin Mavaddat ·
“The standard anti-requirements, we need to identify them and prioritize.”
Transcript evidence from Matin Mavaddat - Understanding Security as a Systemic Concern: The Role of Anti-Requirements.
Said by Chris Romeo ·
“DevSecOps is not build pipelines.”
Transcript evidence from Kayra Otaner -- DevSecOps.
Said by Kayra Otaner ·
“Security as code is implementing security to detect issues with very high false positive rates, right?”
Transcript evidence from Kayra Otaner -- DevSecOps.
Said by Kayra Otaner ·
“In my opinion, ASPM, Application Security Posture Management tools, are the SIEM for AppSec, and it used to be called AppSOC, right?”
Transcript evidence from Kayra Otaner -- DevSecOps.
Said by François Proulx ·
“Like as you said, like you want to only keep the secrets to the part that you absolutely need it.”
Transcript evidence from François Proulx - Arbitrary Code Execution 0-day in Build Pipeline of Popular Open Source Packages.
Said by François Proulx ·
“The code that's coming from the PR, that's, from someone that forked it and opened the PR, you need to consider like, toxic waste.”
Transcript evidence from François Proulx - Arbitrary Code Execution 0-day in Build Pipeline of Popular Open Source Packages.
Said by François Proulx ·
“They tell you if you accept pull requests, you need to treat it like untrusted input and you need to use the workflows to segment them and use the right type of events like Pull request, there are 2 types of events trigger the workflow.”
Transcript evidence from François Proulx - Arbitrary Code Execution 0-day in Build Pipeline of Popular Open Source Packages.
Said by François Proulx ·
“You need to monitor the changes, the new best practice, and make the effort to go in the settings and to follow the recommendation.”
Transcript evidence from François Proulx - Arbitrary Code Execution 0-day in Build Pipeline of Popular Open Source Packages.
Said by Chris Romeo ·
“We could take our top 5 components that we use across our organization and we could do our own threat model of them.”
Transcript evidence from François Proulx - Arbitrary Code Execution 0-day in Build Pipeline of Popular Open Source Packages.
Said by Steve Wilson ·
“You find the relevant data using a reliable query”
Transcript evidence from Steve Wilson -- The Developer's Playbook for Large Language Model Security: Building Secure AI Applications.
Said by Steve Wilson ·
“Taking a new set of untrusted data and exposing your model to it.”
Transcript evidence from Steve Wilson -- The Developer's Playbook for Large Language Model Security: Building Secure AI Applications.
Said by Steve Wilson ·
“You have to treat the LLM as a hostile entity inside your application.”
Transcript evidence from Steve Wilson -- The Developer's Playbook for Large Language Model Security: Building Secure AI Applications.
Said by Steve Wilson ·
“I want, to the best of my ability, to police what's coming in and what's coming out.”
Transcript evidence from Steve Wilson -- The Developer's Playbook for Large Language Model Security: Building Secure AI Applications.
Said by Steve Wilson ·
“Put a real human in the loop, cross-check it?”
Transcript evidence from Steve Wilson -- The Developer's Playbook for Large Language Model Security: Building Secure AI Applications.
Said by Jeff Williams ·
“There's like all this information about how the application works that you need to understand before you can start doing a threat model, before you can start doing a pen test.”
Transcript evidence from Jeff Williams -- Application Detection & Response (ADR).
Said by Jeff Williams ·
“Secure by design to me is positive approach to that.”
Transcript evidence from Jeff Williams -- Application Detection & Response (ADR).
Said by Jeff Williams ·
“Immediately you should think ADR is application security and API security in production.”
Transcript evidence from Jeff Williams -- Application Detection & Response (ADR).
Said by Jeff Williams ·
“You have to get inside the running application and see it as it's running.”
Transcript evidence from Jeff Williams -- Application Detection & Response (ADR).
Said by Phillip Wylie ·
“If you're starting out totally new, then you need to understand operating systems and networking.”
Transcript evidence from Phillip Wylie -- Pen Testing from Somebody who Knows about Pen Testing.
Said by Phillip Wylie ·
“People need to get more exposure to the different areas.”
Transcript evidence from Phillip Wylie -- Pen Testing from Somebody who Knows about Pen Testing.
Said by Phillip Wylie ·
“We need to use it when it's needed to be used, but don't abuse it.”
Transcript evidence from Phillip Wylie -- Pen Testing from Somebody who Knows about Pen Testing.
Said by Steve Springett ·
“CycloneDX helps you identify what is it that you have and do so in a standardized way.”
Transcript evidence from Steve Springett -- Software and System Transparency.
Said by Steve Springett ·
“Add that information to the bill of materials so that it's more accurate than what your SCA tool could ever generate.”
Transcript evidence from Steve Springett -- Software and System Transparency.
Said by Steve Springett ·
“Give me your SBOM.”
Transcript evidence from Steve Springett -- Software and System Transparency.
Said by Steve Springett ·
“It's the services, it's the runtime environment in which it's, it's executed.”
Transcript evidence from Steve Springett -- Software and System Transparency.
Said by Steve Springett ·
“Get involved in these projects if they're important to you.”
Transcript evidence from Steve Springett -- Software and System Transparency.
Said by Irfaan Santoe ·
“You want to increase the maturity of where you are at in order to be able for you to say, I want to grow, you need to understand where you are at.”
Transcript evidence from Irfaan Santoe -- The Power of Strategy in AppSec.
Said by Irfaan Santoe ·
“Try to establish that target state together with your CISO, together with even your CIO.”
Transcript evidence from Irfaan Santoe -- The Power of Strategy in AppSec.
Said by Irfaan Santoe ·
“I would start with setting the baseline.”
Transcript evidence from Irfaan Santoe -- The Power of Strategy in AppSec.
Said by Irfaan Santoe ·
“The key thing over here is you have to take risk within what we call the risk appetite.”
Transcript evidence from Irfaan Santoe -- The Power of Strategy in AppSec.
Said by Irfaan Santoe ·
“I think before introducing any new control on an enterprise level for your organization, take a step back and say, is this something that's going to scale?”
Transcript evidence from Irfaan Santoe -- The Power of Strategy in AppSec.
Said by Andrew van der Stock ·
“We do like to see a spread of CWEs over the data we receive.”
Transcript evidence from Andrew Van Der Stock -- The New OWASP Top Ten.
Said by Andrew van der Stock ·
“But my message to everybody listening to this podcast is the order is unimportant. Do all of them because it's only 10 things.”
Transcript evidence from Andrew Van Der Stock -- The New OWASP Top Ten.
Said by Andrew van der Stock ·
“I think developer education is overrated. And I think what we need to do is get to the frameworks and say to the frameworks, you need to fix these things based around the ASVS.”
Transcript evidence from Andrew Van Der Stock -- The New OWASP Top Ten.
Said by Andrew van der Stock ·
“What happens is that people don't think about the negative access control consequences. And so they don't write user stories that incorporate them.”
Transcript evidence from Andrew Van Der Stock -- The New OWASP Top Ten.
Said by Andrew van der Stock ·
“If you have a collection of CWE data that is easily extractable, doesn't matter the size of the contribution. If you've got 10 apps, if you've got 100,000 apps, we'd love to talk to you.”
Transcript evidence from Andrew Van Der Stock -- The New OWASP Top Ten.
Said by Chris Romeo ·
“You have to take more entry-level people and you have to provide them a pathway to grow them, to mentor them so that they could become those mid to high-level roles.”
Transcript evidence from Derek Fisher -- Hiring in Cyber/AppSec.
Said by Derek Fisher ·
“You need to Tell, and it's hard to do this on a resume, but you need to tell a story.”
Transcript evidence from Derek Fisher -- Hiring in Cyber/AppSec.
Said by Chris Romeo ·
“I wouldn't recommend making it a cutoff point where you're like, oh, if you don't have CISSP, you can't do this job.”
Transcript evidence from Derek Fisher -- Hiring in Cyber/AppSec.
Said by Tanya Janca ·
“To me, a secure guardrail is some technical implementation that tries to get you— it tells you, hey, you're not doing what you should do from a security perspective.”
Transcript evidence from Tanya Janca -- Secure Guardrails.
Said by Robert Hurlbut ·
“We try to make it a default in every opportunity so that it's easiest to do the thing we want you to do.”
Transcript evidence from Tanya Janca -- Secure Guardrails.
Said by Tanya Janca ·
“To be quite frank, if it looks like a secret, I'd like it to be in blocking mode, period, right?”
Transcript evidence from Tanya Janca -- Secure Guardrails.
Said by Jahanzeb Farooq ·
“Find out who needs what, who needs our help, and who these developers are, where they are located in the organization, what is the level of awareness when it comes to security”
Transcript evidence from Jahanzeb Farooq -- Launching and executing an AppSec program.
Said by Jahanzeb Farooq ·
“Find out what help they need. What is the current state of their security practices”
Transcript evidence from Jahanzeb Farooq -- Launching and executing an AppSec program.
Said by Jahanzeb Farooq ·
“Depending on the maturity level, then I will decide, okay, we should have this and this in place.”
Transcript evidence from Jahanzeb Farooq -- Launching and executing an AppSec program.
Said by Jahanzeb Farooq ·
“Go through OpenSAM and BSIMM, these, all these benchmark studies to see, okay, what other organizations in the same sector, what do they have”
Transcript evidence from Jahanzeb Farooq -- Launching and executing an AppSec program.
Said by Jahanzeb Farooq ·
“I would go for a SAST tool, which is a tool, an automated way of reviewing your code for security weaknesses.”
Transcript evidence from Jahanzeb Farooq -- Launching and executing an AppSec program.
Said by David Quisenberry ·
“With application security, starting with something like a BSIM framework, where you're looking across the different domains and take, take the existing— because every company, regardless of whether they have a dedicated security program or not, or a very well-built-out one, like, they're going to have some of the practices.”
Transcript evidence from David Quisenberry -- Building Security, People, and Programs.
Said by David Quisenberry ·
“We have to make sure that we're focusing on the threats that, if, acted upon, would do the most harm to the business.”
Transcript evidence from David Quisenberry -- Building Security, People, and Programs.
Said by David Quisenberry ·
“Don't come in with like, security says X, like lead with the why.”
Transcript evidence from David Quisenberry -- Building Security, People, and Programs.
Said by Chris Romeo ·
“We need to start investing more in security.”
Transcript evidence from Matt Rose -- Software Supply Chain Security Means Many Different Things to Different People.
Said by Chris Romeo ·
“We need to treat the AI like an intern.”
Transcript evidence from Matt Rose -- Software Supply Chain Security Means Many Different Things to Different People.
Said by Matt Rose ·
“People have to change the way they perceive or want to learn about technology.”
Transcript evidence from Matt Rose -- Software Supply Chain Security Means Many Different Things to Different People.
Said by James Berthoty ·
“If you want to manage infrastructure in the cloud, if you start managing like Terraform deployments, you are one step away from like Python scripts to start doing things.”
Transcript evidence from James Berthoty -- Is DAST Dead? And the future of API security.
Said by James Berthoty ·
“I think that, uh, there is a big demand for API security.”
Transcript evidence from James Berthoty -- Is DAST Dead? And the future of API security.
Said by James Berthoty ·
“I was looking at the logs of the scan and like every log was like, it was trying to send like dumb payloads that weren't even in the right format.”
Transcript evidence from James Berthoty -- Is DAST Dead? And the future of API security.
Said by Speaker not identified ·
“We need to make a commitment to them for a couple of years to make sure they've got enough breathing space.”
Transcript evidence from Mark Curphey and Simon Bennetts -- Riding the Coat Tails of ZAP, without Open Source Funding.
Said by Speaker not identified ·
“Let's keep the people making money out of it, figure out how to go support it because they should be held, let's hold them accountable for going and doing it.”
Transcript evidence from Mark Curphey and Simon Bennetts -- Riding the Coat Tails of ZAP, without Open Source Funding.
Said by Speaker not identified ·
“They need to own this thing. They need to control their own, their own roadmap”
Transcript evidence from Mark Curphey and Simon Bennetts -- Riding the Coat Tails of ZAP, without Open Source Funding.
Said by Devin Rudnicki ·
“First off, I built a roadmap that I could use to socialize my vision for the program and communicate with the key stakeholders what would be needed from them.”
Transcript evidence from Devin Rudnicki -- Expanding AppSec.
Said by Devin Rudnicki ·
“Then be able to tailor your conversation to meet not only your needs, obviously, but their needs.”
Transcript evidence from Devin Rudnicki -- Expanding AppSec.
Said by Devin Rudnicki ·
“We wanted to make sure that as much of the process was automated as possible.”
Transcript evidence from Devin Rudnicki -- Expanding AppSec.
Said by Devin Rudnicki ·
“We did try to show the value as far as showing the vulnerability closure rates and showing the trends and vulnerabilities from quarter to quarter or month to month, depending on what level of reporting you were doing.”
Transcript evidence from Devin Rudnicki -- Expanding AppSec.
Said by Devin Rudnicki ·
“You need to understand how your organization makes money, and you need to understand what can you do as a security leader to help enable that.”
Transcript evidence from Devin Rudnicki -- Expanding AppSec.
Said by Dustin Lehr ·
“When you're designing your champion program, you need to think about what are the rewards and incentives that you're going to offer.”
Transcript evidence from Dustin Lehr -- Culture Change through Champions and Gamification.
Said by Dustin Lehr ·
“If that's part of our plan this year, we need to get our stuff together when it comes to security.”
Transcript evidence from Dustin Lehr -- Culture Change through Champions and Gamification.
Said by Chris Romeo ·
“You have to build a strong, uh, team that can drive this thing, because you want that champions program to exist years into the future, not be, so many champions programs are a flash in the pan.”
Transcript evidence from Dustin Lehr -- Culture Change through Champions and Gamification.
Said by Francesco Cipollone ·
“Product security was born, uh, as an idea to paint a picture of what you build, where you run it, and communicating that to the business.”
Transcript evidence from Francesco Cipollone -- Application Security Posture Management and the Power of Working with the Business.
Said by Francesco Cipollone ·
“You need three vertical into your brain, the business aspect, the security aspect, um, and a little bit development aspect.”
Transcript evidence from Francesco Cipollone -- Application Security Posture Management and the Power of Working with the Business.
Said by Francesco Cipollone ·
“You build this nice, secure structure for the cloud with the right access control”
Transcript evidence from Francesco Cipollone -- Application Security Posture Management and the Power of Working with the Business.
Said by Mukund Sarma ·
“We need to work with the platform team to help them, help them add security controls on them.”
Transcript evidence from Mukund Sarma -- Developer Tools that Solve Security Problems.
Said by Mukund Sarma ·
“You should make sure there is appetite to even start some of this work in that whole problem of space and then start looking at it.”
Transcript evidence from Mukund Sarma -- Developer Tools that Solve Security Problems.
Said by Mukund Sarma ·
“You have to make sure that there is room for, like, this person to grow and engage and be part of a bigger function too.”
Transcript evidence from Mukund Sarma -- Developer Tools that Solve Security Problems.
Said by Meghan Jacquot ·
“Um, and so like how a threat actor could gain access and they've done a breach, um, if you're doing an assumed breach activity, you are given access.”
Transcript evidence from Meghan Jacquot -- Assumed Breach Red Team Engagements for AppSec.
Said by Meghan Jacquot ·
“We want you to test if you have no login, we want you to test if you have a lower level login, we want you to test if you have super admin, and so you could set up a variety of different scenarios.”
Transcript evidence from Meghan Jacquot -- Assumed Breach Red Team Engagements for AppSec.
Said by Chris Romeo ·
“Um, let me give a piece of advice to everybody out there submitting for CFP, ChatGPT is not your friend, okay?”
Transcript evidence from Meghan Jacquot -- Assumed Breach Red Team Engagements for AppSec.
Said by Bill Sempf ·
“It's, I continued when the software development side for a long time, but I was always the security guy on the dev team and eventually, um, I got off on a long, tiring project and went looking for something else to do and vulnerability assessment was one of the options.”
Transcript evidence from Bill Sempf -- Development, Security, and Teaching the Next Generation.
Said by Bill Sempf ·
“Um, so it's, it's, it went fairly well, but, um, I more or less walked through the, what I used in, not only with these two, um, but, with, um, Scouts, working with Scouts for years and years, and working with KidsMatch, um, and being the advice giver in the family for people who, have”
Transcript evidence from Bill Sempf -- Development, Security, and Teaching the Next Generation.
Said by Bill Sempf ·
“Um, and, um, I think that, yeah, people who are in application security with a primarily network background should go to developer conferences and see what the developers are dealing with.”
Transcript evidence from Bill Sempf -- Development, Security, and Teaching the Next Generation.
Said by Hendrik Ewerlin ·
“Ask other people what they think, so this will improve it even further.”
Transcript evidence from Hendrik Ewerlin -- Threat Modeling of Threat Modeling.
Said by Hendrik Ewerlin ·
“You need a paved road and so you're ready to go.”
Transcript evidence from Hendrik Ewerlin -- Threat Modeling of Threat Modeling.
Said by Hendrik Ewerlin ·
“Training can be too theoretical.”
Transcript evidence from Hendrik Ewerlin -- Threat Modeling of Threat Modeling.
Said by Hendrik Ewerlin ·
“Rather start and then divide and conquer, choose a level of abstraction that works”
Transcript evidence from Hendrik Ewerlin -- Threat Modeling of Threat Modeling.
Said by Hendrik Ewerlin ·
“Threat model every story. So at least consider if it has some security impacts.”
Transcript evidence from Hendrik Ewerlin -- Threat Modeling of Threat Modeling.
Said by Jason Nelson ·
“It's not enough to have a process written down. It's about the ability to reproduce the same outcome.”
Transcript evidence from Jason Nelson -- Three Pillars of Threat Modeling Success: Consistency, Repeatability, and Efficacy.
Said by Jason Nelson ·
“The, this, the meeting that you're having that you described, that should be part of your consistent process.”
Transcript evidence from Jason Nelson -- Three Pillars of Threat Modeling Success: Consistency, Repeatability, and Efficacy.
Said by Jason Nelson ·
“Once you get to scale and you have tens of thousands of applications and on a ton of infrastructure, you have to define your scope of what you can cover.”
Transcript evidence from Jason Nelson -- Three Pillars of Threat Modeling Success: Consistency, Repeatability, and Efficacy.
Said by Jason Nelson ·
“It's not linting code. It's performing the test.”
Transcript evidence from Jason Nelson -- Three Pillars of Threat Modeling Success: Consistency, Repeatability, and Efficacy.
Said by Jason Nelson ·
“Bring that to the forefront for everybody's mind of figure out why you're doing this.”
Transcript evidence from Jason Nelson -- Three Pillars of Threat Modeling Success: Consistency, Repeatability, and Efficacy.
Said by Erik Cabetas ·
“He's like, you should go play DEF CON CTF.”
Transcript evidence from Erik Cabetas -- Cracking Codes on Screen and in Contests: An Expert's View on Hacking, Vulnerabilities, and the Evolution of Cybersecurity Language.
Said by Erik Cabetas ·
“Talk to any of them, but please don't like go get somebody that doesn't know what they're doing.”
Transcript evidence from Erik Cabetas -- Cracking Codes on Screen and in Contests: An Expert's View on Hacking, Vulnerabilities, and the Evolution of Cybersecurity Language.
Said by Erik Cabetas ·
“Figure that out, and we have to use these more modern languages that are fully featured, but yet manage the memory for you a bit.”
Transcript evidence from Erik Cabetas -- Cracking Codes on Screen and in Contests: An Expert's View on Hacking, Vulnerabilities, and the Evolution of Cybersecurity Language.
Said by Erik Cabetas ·
“You have to get out of the idea of, let me, like, show you how cool I am with finding vulns and let me affect positively the way this business is run.”
Transcript evidence from Erik Cabetas -- Cracking Codes on Screen and in Contests: An Expert's View on Hacking, Vulnerabilities, and the Evolution of Cybersecurity Language.
Said by Justin Collins ·
“Enabling the business to move faster, comma, securely”
Transcript evidence from Justin Collins -- Enabling the Business to Move Faster, Securely.
Said by Justin Collins ·
“You need to understand how your business is functioning.”
Transcript evidence from Justin Collins -- Enabling the Business to Move Faster, Securely.
Said by Chris Romeo ·
“You have to assess, you have to, you have to catch the wave of what's happening inside this company.”
Transcript evidence from Justin Collins -- Enabling the Business to Move Faster, Securely.
Said by Chris Romeo ·
“What's reasonable telling someone that you can't have critical vulnerabilities in your project or in your product? it's not reasonable because back on the software supply chain they take in a They use a component that's critical to the functionality of whatever it is that they're selling whatever their products”
Transcript evidence from Kyle Kelly -- The Dumpster Fire of Software Supply Chain Security.
Said by Chris Romeo ·
“I think of that as a best practice as well and I'll even genericize it a little bit more and say Proxy, a third party dependency proxy is the capability.”
Transcript evidence from Kyle Kelly -- The Dumpster Fire of Software Supply Chain Security.
Said by Kyle Kelly ·
“Starts off with an open source policy, um, or SDLC policy, whatever you want it.”
Transcript evidence from Kyle Kelly -- The Dumpster Fire of Software Supply Chain Security.
Said by Chris Romeo ·
“It's like, it's not the answer.”
Transcript evidence from Chris Hughes -- Software Transparency.
Said by Chris Romeo ·
“Having gone through SOC 2, like it's, it is, it's a minimum bar, right, but it's not a bad minimum bar.”
Transcript evidence from Chris Hughes -- Software Transparency.
Said by Chris Hughes ·
“This one, I'd say, one piece of advice I often give security peers is be empathetic, go out and try to understand the incentives and things that people are doing and why they're doing them, what things are driving them to do what they're doing, because often it's, it's simple for us to say,”
Transcript evidence from Chris Hughes -- Software Transparency.
Said by Jay Bobo ·
“We need to utilize a systems thinking approach, right, as opposed to local optimizations.”
Transcript evidence from Jay Bobo & Darylynn Ross -- App Sec Is Dead. Product Security Is the Future..
Said by Chris Romeo ·
“They don't, don't talk technical, talk about the business need, the business function, the business result that we're all trying to get to.”
Transcript evidence from Jay Bobo & Darylynn Ross -- App Sec Is Dead. Product Security Is the Future..
Said by Jay Bobo ·
“But if we want to get something that is valuable, For, uh, us, then we need to move away from this black box, gray box testing, and we need to get into something where opening stuff up and starting to get into some of the business logic issues.”
Transcript evidence from Jay Bobo & Darylynn Ross -- App Sec Is Dead. Product Security Is the Future..
Said by Jay Bobo ·
“I would say, optimize, uh, first one, optimize for people, share your security results, reports, findings with your engineers.”
Transcript evidence from Jay Bobo & Darylynn Ross -- App Sec Is Dead. Product Security Is the Future..
Said by Darylynn Ross ·
“I'm going to take the time and I'm going to listen to their problem and then, uh, collaborate with them to try to find an answer.”
Transcript evidence from Jay Bobo & Darylynn Ross -- App Sec Is Dead. Product Security Is the Future..
Said by Chris Romeo ·
“Trust but verify has been the mantra for security.”
Transcript evidence from Eitan Worcel -- Is AI a Security Champion?.
Said by Eitan Worcel ·
“I think that the security team needs to be involved and see the fix to approve it.”
Transcript evidence from Eitan Worcel -- Is AI a Security Champion?.
Said by Eitan Worcel ·
“Don't have it fixed path reversal if you don't trust that fix.”
Transcript evidence from Eitan Worcel -- Is AI a Security Champion?.
Said by Bjorn Kimminich ·
“Everything that you do is only happening on the test net.”
Transcript evidence from Björn Kimminich -- OWASP Juice Shop.
Said by Bjorn Kimminich ·
“I don't want people to leave actual XSS attacks in the Juice Shop database.”
Transcript evidence from Björn Kimminich -- OWASP Juice Shop.
Said by Bjorn Kimminich ·
“You have to select the actual line or multiple lines, which are causing the problem”
Transcript evidence from Björn Kimminich -- OWASP Juice Shop.
Said by Bjorn Kimminich ·
“If you pick the wrong one, you get some hint explaining why this is not correct.”
Transcript evidence from Björn Kimminich -- OWASP Juice Shop.
Said by Bjorn Kimminich ·
“The reported things are reasonable”
Transcript evidence from Björn Kimminich -- OWASP Juice Shop.
Said by Chris Romeo ·
“My, the practice that I've adopted is, uh, for my previous startup and for my existing startup is, I have a wide group of people interview any candidate, and anybody can be thumbs down.”
Transcript evidence from Arshan Dabirsiaghi -- Security Startups, AI Influencing AppSec, and Pixee/Codemodder.io.
Said by Arshan Dabirsiaghi ·
“We were both uh, we were leaving at the same time and, uh, we got to talking about the different problems, uh, that AppSec, that there weren't AppSec left to solve.”
Transcript evidence from Arshan Dabirsiaghi -- Security Startups, AI Influencing AppSec, and Pixee/Codemodder.io.
Said by Arshan Dabirsiaghi ·
“Uh, we're still pretty early, so we don't, unfortunately we don't have time for everything yet, but we absolutely, they know that's one of the reasons we, it's primary reason we made it open source is we want people to be able to build codemods and do whatever you want with them.”
Transcript evidence from Arshan Dabirsiaghi -- Security Startups, AI Influencing AppSec, and Pixee/Codemodder.io.
Said by Dr. Jared Demott ·
“I think it could vary a lot because I suppose there's no reason why a startup or any other company couldn't offer some rudimentary bug bounty type, program or something, but in general, I would agree, if you haven't done the fundamental, especially if you have a, if you're an older company”
Transcript evidence from Dr. Jared Demott -- Cloud Security & Bug Bounty.
Said by Dr. Jared Demott ·
“But for example, you could either use whitelists or blacklists and allow lists or deny lists as far as like, there should never be a, internal address in those parameters.”
Transcript evidence from Dr. Jared Demott -- Cloud Security & Bug Bounty.
Said by Dr. Jared Demott ·
“All the things that are in the SDLC, like security training and code reviews and automating and CICD and, security champions, like I feel like on any level, whether a company is small or large, you can find a way to do that in a way that makes sense to you.”
Transcript evidence from Dr. Jared Demott -- Cloud Security & Bug Bounty.
Said by Katharina Koerner ·
“Protecting personal data is one of the things that we protect with security, but it's so hard to stay updated on those various threats and defenses, um, related to machine learning systems.”
Transcript evidence from Katharina Koerner -- Security as Responsible AI.
Said by Katharina Koerner ·
“Anytime we have, uh, a machine AI or machine learning processing personal data, we're in the realm of privacy.”
Transcript evidence from Katharina Koerner -- Security as Responsible AI.
Said by Katharina Koerner ·
“They see that the principal, responsible AI principles are interdependent.”
Transcript evidence from Katharina Koerner -- Security as Responsible AI.
Said by Ray Espinoza ·
“We may have somebody who's like a principal architect and we need to work towards like, um, a principal fellow or something else.”
Transcript evidence from Ray Espinoza -- The AppSec CISO, Vendor Relationships, and Mentoring.
Said by Ray Espinoza ·
“I think it's super important to give back.”
Transcript evidence from Ray Espinoza -- The AppSec CISO, Vendor Relationships, and Mentoring.
Said by Ray Espinoza ·
“See if you can make that little bit of time to be able to, uh, help them out.”
Transcript evidence from Ray Espinoza -- The AppSec CISO, Vendor Relationships, and Mentoring.
Said by Chris John Riley ·
“We're using it as an underpinning for our new vendor assessment processes to be able to improve those, speed them up, and make sure that things coming into our process are a lot better quality.”
Transcript evidence from Chris John Riley -- MVSP: Minimum Viable Secure Product.
Said by Chris John Riley ·
“If there's an issue, you need to have identified the logs you require up front, because if you're trying to change your logging when an incident happens, you've already lost.”
Transcript evidence from Chris John Riley -- MVSP: Minimum Viable Secure Product.
Said by Chris John Riley ·
“Our goal with MVSP is can you build that solid foundation and then if you want more from a product, it's easier to build that on top of a strong foundation and a good understanding of how things fit together.”
Transcript evidence from Chris John Riley -- MVSP: Minimum Viable Secure Product.
Said by Gavin Klondike ·
“Identify any strengths and weaknesses at each trust boundary in this application.”
Transcript evidence from Steve Wilson and Gavin Klondike -- OWASP Top Ten for LLM Release.
Said by Gavin Klondike ·
“You have to ask it in more and more unique and clever ways.”
Transcript evidence from Steve Wilson and Gavin Klondike -- OWASP Top Ten for LLM Release.
Said by Gavin Klondike ·
“What we can do is separate the tenants.”
Transcript evidence from Steve Wilson and Gavin Klondike -- OWASP Top Ten for LLM Release.
Said by Tanya Janca ·
“Whenever we can choose the newer thing, we should choose the newer thing.”
Transcript evidence from Tanya Janca -- What Secure Coding Really Means.
Said by Tanya Janca ·
“I'd rather only find 10 bugs that are all true positives.”
Transcript evidence from Tanya Janca -- What Secure Coding Really Means.
Said by Tanya Janca ·
“Make sure what you're receiving makes sense before you use it.”
Transcript evidence from Tanya Janca -- What Secure Coding Really Means.
Said by Hasan Yasar ·
“Yes, we have to write the secure coding, but we have to know why it's important.”
Transcript evidence from Hasan Yasar -- Actionable SBOM via DevSecOps.
Said by Chris Romeo ·
“We should start with input validation before we even let them, before we even let them take a single line off the command line.”
Transcript evidence from Hasan Yasar -- Actionable SBOM via DevSecOps.
Said by Hasan Yasar ·
“We have to use those files somehow to integrate our deployment scripts.”
Transcript evidence from Hasan Yasar -- Actionable SBOM via DevSecOps.
Said by Varun Badhwar ·
“One way is you do it statically.”
Transcript evidence from Varun Badhwar -- The Developer Productivity Tax.
Said by Varun Badhwar ·
“What we are after is shifting that whole thing all the way left to the point in time when the developer says, I want to use a new open source project.”
Transcript evidence from Varun Badhwar -- The Developer Productivity Tax.
Said by Varun Badhwar ·
“The right approach architecturally is to have this concept of a parallel security pipeline”
Transcript evidence from Varun Badhwar -- The Developer Productivity Tax.
Said by Steve ·
“The processes in order to obtain funding are entirely too complex.”
Transcript evidence from OWASP Board of Directors Debate.
Said by Steve ·
“We have to start engaging, uh, developer communities that we are”
Transcript evidence from OWASP Board of Directors Debate.
Said by Paulino ·
“Focus and give the resources that they need to the flagship projects”
Transcript evidence from OWASP Board of Directors Debate.
Said by Izar ·
“We have to make it clear what is it that OWASP is going to provide to each one of these projects.”
Transcript evidence from OWASP Board of Directors Debate.
Said by Sam ·
“We need to define the longevity and sustainability of the projects”
Transcript evidence from OWASP Board of Directors Debate.
Said by Itzik Alvas ·
“First of all, get a list. Understand how many secrets you have, where are they, then enrich them, classify them, understand their blast radius, and then monitor them for any anomaly.”
Transcript evidence from Itzik Alvas -- Secrets Security and Management.
Said by Itzik Alvas ·
“You need to monitor how your secrets are being used and from where.”
Transcript evidence from Itzik Alvas -- Secrets Security and Management.
Said by Itzik Alvas ·
“Start deleting those secrets and start protecting them.”
Transcript evidence from Itzik Alvas -- Secrets Security and Management.
Said by Itzik Alvas ·
“You want to decrease the secret permissions, right?”
Transcript evidence from Itzik Alvas -- Secrets Security and Management.
Said by Itzik Alvas ·
“Pick something you can do tomorrow, start easy, and do it.”
Transcript evidence from Itzik Alvas -- Secrets Security and Management.
Said by Harshil Parikh ·
“Be, uh, don't try to sell stuff by creating FUD.”
Transcript evidence from Harshil Parikh -- Deep Environmental and Organizational Context in Application Security.
Said by Harshil Parikh ·
“If you make it easy for developers to fix and remediate those risks, that's going to be the single most impactful thing in, uh, in mitigation, right?”
Transcript evidence from Harshil Parikh -- Deep Environmental and Organizational Context in Application Security.
Said by Harshil Parikh ·
“Building those guardrails makes it easier for developers to make the right choices from the beginning, um, so”
Transcript evidence from Harshil Parikh -- Deep Environmental and Organizational Context in Application Security.
Said by Harshil Parikh ·
“You have to use these crypto frameworks when you're writing anything related to crypto.”
Transcript evidence from Harshil Parikh -- Deep Environmental and Organizational Context in Application Security.
Said by Harshil Parikh ·
“By improving the developer experience, giving them context about why they should pay attention to certain things and being cognizant of the organizational decision making”
Transcript evidence from Harshil Parikh -- Deep Environmental and Organizational Context in Application Security.
Said by Jeff Williams ·
“With IAST, you can get much higher quality results. Finish within your normal pipeline.”
Transcript evidence from Jeff Williams -- The Tech of Runtime Security.
Said by Jeff Williams ·
“There's, there's literally nothing that you have to change about the way that you build, test, or deploy code to get value from IAST.”
Transcript evidence from Jeff Williams -- The Tech of Runtime Security.
Said by Jeff Williams ·
“I think balancing those two things is the right strategy.”
Transcript evidence from Jeff Williams -- The Tech of Runtime Security.
Said by Mark Curphey ·
“Understand the end-to-end software engineering process and all the big pieces about it”
Transcript evidence from Mark Curphey and John Viega -- Chalk.
Said by John Viega ·
“Pretty much any friction is enough to derail it.”
Transcript evidence from Mark Curphey and John Viega -- Chalk.
Said by Mark Curphey ·
“90% of them you kill in the first place.”
Transcript evidence from Mark Curphey and John Viega -- Chalk.
Said by Mark Curphey ·
“Listening to someone about what the actual problem is, and how they would like to go solve it”
Transcript evidence from Mark Curphey and John Viega -- Chalk.
Said by Maril Vernon ·
“We have to get all those people together.”
Transcript evidence from Maril Vernon -- You Get What You Inspect, Not What You Expect.
Said by Maril Vernon ·
“Automate as much as possible so you can spend, that 20% of your precious manual time on the things that matter, the big impact items, the blast radius items.”
Transcript evidence from Maril Vernon -- You Get What You Inspect, Not What You Expect.
Said by Maril Vernon ·
“I think that a lot more people should get on collab calls and see what happens, see what products emerge as a result, see who starts collabing on stuff.”
Transcript evidence from Maril Vernon -- You Get What You Inspect, Not What You Expect.
Said by Dan Küykendall ·
“Start off with, SQL and then cross-site scripting and the fundamentals of why those, like, how those happen, right?”
Transcript evidence from Dan Küykendall -- Why All Application Security Products Suck.
Said by Dan Küykendall ·
“If you don't understand the limitations of a given tool, if you don't understand its strengths and weaknesses and understand its both of those, you're not gonna pick the right tools.”
Transcript evidence from Dan Küykendall -- Why All Application Security Products Suck.
Said by Dan Küykendall ·
“I would probably grab an SCA product so that I could make sure that the packages that that we're pulling in, That we have some understanding of what's coming into our project. So I would probably look at an SCA tool off the bat and um, generally, again, this depends on what language you're using and all that stuff, but I would probably, the next thing would probably be a SAST is I would probably, especially if I'm that early, I would want to be making sure we're monitoring the code as closely as possible.”
Transcript evidence from Dan Küykendall -- Why All Application Security Products Suck.
Said by Kevin Johnson ·
“A bootable CD that gave them a Linux environment that had web pen testing tools pre-installed.”
Transcript evidence from Kevin Johnson -- Samurai Swords and Zap's Departure.
Said by Kevin Johnson ·
“The first, the first path is I want to use SamuraiWTF as a way for me to learn application security.”
Transcript evidence from Kevin Johnson -- Samurai Swords and Zap's Departure.
Said by Kevin Johnson ·
“Um, but there has been a push for the last, I don't know, year that OWASP has to figure out how to help fund chapters and projects and promote itself to the community.”
Transcript evidence from Kevin Johnson -- Samurai Swords and Zap's Departure.
Said by Tony Quadros ·
“Make sure your team follows through, right, that the company you work for and always do what you say and say what you do.”
Transcript evidence from Tony Quadros -- The Life of an AppSec Vendor.
Said by Tony Quadros ·
“You need to explain how your product will provide business value”
Transcript evidence from Tony Quadros -- The Life of an AppSec Vendor.
Said by Chris Romeo ·
“Read the message that they sent me and here's my, here's what's going on in my head because I'm a security practitioner first.”
Transcript evidence from Tony Quadros -- The Life of an AppSec Vendor.
Said by Steve Giguere ·
“Bridgecrew, which focused on cloud and infrastructure's code security”
Transcript evidence from Steve Giguere -- Cloud AppSec.
Said by Steve Giguere ·
“Don't forget about open source, because there's a lot of free security out there through OWASP and otherwise”
Transcript evidence from Steve Giguere -- Cloud AppSec.
Said by Steve Giguere ·
“I am a huge fan of Trivy.”
Transcript evidence from Steve Giguere -- Cloud AppSec.
Said by Paul McCarty ·
“They typically don't use the same security controls in Dev and Staging.”
Transcript evidence from Paul McCarty -- The Burrito Analogy of the Software Supply Chain.
Said by Paul McCarty ·
“People start to, want to secure the software supply chain”
Transcript evidence from Paul McCarty -- The Burrito Analogy of the Software Supply Chain.
Said by Chris Romeo ·
“Developers should understand because they may encounter threats and different components here that we as security people haven't even thought about yet.”
Transcript evidence from Paul McCarty -- The Burrito Analogy of the Software Supply Chain.
Said by Farshad Abasi ·
“The important ones, that's the ones we assigned the AppSec consultants.”
Transcript evidence from Farshad Abasi -- Three Models for Deploying AppSec Resources.
Said by Farshad Abasi ·
“By using that filter, we would reduce the number of user stories we had to look at.”
Transcript evidence from Farshad Abasi -- Three Models for Deploying AppSec Resources.
Said by Chris Romeo ·
“The third model is the champion or deputy model where the AppSec team deputizes developers to do the bulk of the application security work, and the AppSec team becomes a resource and escalation point for more complex problems.”
Transcript evidence from Farshad Abasi -- Three Models for Deploying AppSec Resources.
Said by Farshad Abasi ·
“Then we would set up these weekly sessions where we would work at a mentorship capacity, where they would bring that filtered list of user stories, not all of them.”
Transcript evidence from Farshad Abasi -- Three Models for Deploying AppSec Resources.
Said by Farshad Abasi ·
“Usually after three to six months, they'd be like, okay, now we're gonna stop doing it.”
Transcript evidence from Farshad Abasi -- Three Models for Deploying AppSec Resources.
Said by Kim Wuyts ·
“Lindon is a privacy threat modeling approach, very similar to STRIDE, the security threat modeling approach created at Microsoft.”
Transcript evidence from Kim Wuyts -- The Future of Privacy Threat Modeling.
Said by Kim Wuyts ·
“You need to work on data lifecycle management because, well, privacy, it's all about personal data, so that needs to be managed.”
Transcript evidence from Kim Wuyts -- The Future of Privacy Threat Modeling.
Said by Kim Wuyts ·
“It can definitely be done together, but you need to like change heads going because you have different viewpoints to tackle that. But it can definitely be done and it should be done.”
Transcript evidence from Kim Wuyts -- The Future of Privacy Threat Modeling.
Said by Kim Wuyts ·
“The sooner you start with that, ideally at ideation already, the sooner you can start thinking of, well, okay, this is the end goal. This is the thing we want to achieve. Now, do we need to do that in that way that we think we, I don't know, need to have our users have their location data shared with us 24/7?”
Transcript evidence from Kim Wuyts -- The Future of Privacy Threat Modeling.
Said by Kim Wuyts ·
“You have a set of strategies and tactics created by Jaap-Henk Hoekman, who is a Dutch professor, and his PhD student, former PhD student, Michael Kolesky, and the tactics there, they have They call it Little Blue Book, I think, with a lot of privacy strategies that say like, you need to minimize, you need to hide, you need to enforce.”
Transcript evidence from Kim Wuyts -- The Future of Privacy Threat Modeling.
Said by François Proulx ·
“After engineering school, did a bunch of CTFs to practice and put to good use those security skills”
Transcript evidence from François Proulx -- Actionable Software Supply Chain Security.
Said by François Proulx ·
“Literally building an application security program from zero, as like my first full-time security job”
Transcript evidence from François Proulx -- Actionable Software Supply Chain Security.
Said by François Proulx ·
“There's no GitHub, so no pull request, but we're still doing some code review.”
Transcript evidence from François Proulx -- Actionable Software Supply Chain Security.
Said by Steve Wilson ·
“Most large language models, the way anybody's going to encounter them, they're embedded in a web application.”
Transcript evidence from Steve Wilson -- OWASP Top Ten for LLMs.
Said by Steve Wilson ·
“Every piece of chat that comes in is a piece of untrusted data that unless you do something about it is going direct into your software.”
Transcript evidence from Steve Wilson -- OWASP Top Ten for LLMs.
Said by Steve Wilson ·
“People will make layered architectures where they create very specific models that are only worried about screening for things like prompt injection.”
Transcript evidence from Steve Wilson -- OWASP Top Ten for LLMs.
Said by Steve Wilson ·
“Limit the length of the prompt you're willing to take.”
Transcript evidence from Steve Wilson -- OWASP Top Ten for LLMs.
Said by Steve Wilson ·
“Start to get familiar with the base technology.”
Transcript evidence from Steve Wilson -- OWASP Top Ten for LLMs.
Said by JB Aviat ·
“If, uh, you have like hundreds of services to remediate, well, you need to prioritize.”
Transcript evidence from JB Aviat -- The State of Application Security.
Said by JB Aviat ·
“People that, uh, use data, they usually tag the environments, right?”
Transcript evidence from JB Aviat -- The State of Application Security.
Said by Chris Romeo ·
“In non-production environments before they launch an attack against a production.”
Transcript evidence from JB Aviat -- The State of Application Security.
Said by Joshua Wells ·
“Make sure that my— based off of the operating system, let's say I have regular iOS updates, the latest updates.”
Transcript evidence from Joshua Wells -- Application Security in the Age of Zero Trust.
Said by Joshua Wells ·
“If you're a DevOps guy and you're working in, let's say, AWS, you're working in GCP, you're managing some type of application that's embedded on a container, you have to make sure that application is secure.”
Transcript evidence from Joshua Wells -- Application Security in the Age of Zero Trust.
Said by Joshua Wells ·
“I would say my takeaway and my recommendation is don't be afraid to adjust with the times when it comes to security.”
Transcript evidence from Joshua Wells -- Application Security in the Age of Zero Trust.
Said by Jeevan Singh ·
“Directing that influence at the leadership level, making sure that you're focusing on, um, engineering leadership or the execs and making sure that they understand why it's important to do whatever you need to do.”
Transcript evidence from Jeevan Singh -- The Future of Application Security Engineers.
Said by Jeevan Singh ·
“You shouldn't be fixing vulnerabilities yourself. You should be guiding the business to fix vulnerabilities and being able to influence the, uh, business to fix vulnerabilities at scale.”
Transcript evidence from Jeevan Singh -- The Future of Application Security Engineers.
Said by Jeevan Singh ·
“Which is why we have to rely on the teaching aspect and allowing them to do the heavy lifting there.”
Transcript evidence from Jeevan Singh -- The Future of Application Security Engineers.
Said by Chris Romeo ·
“Establish the governance from an SLA perspective.”
Transcript evidence from Jeevan Singh -- The Future of Application Security Engineers.
Said by Jeevan Singh ·
“Think about how you can ensure that the programs that you build will last longer than you and those that are good in both of those domain.”
Transcript evidence from Jeevan Singh -- The Future of Application Security Engineers.
Said by Tony Turner ·
“Yes, I have a potential vulnerability problem, but what now”
Transcript evidence from Tony Turner -- Threat Modeling and SBOM.
Said by Tony Turner ·
“Either you need to understand the code or I need to be inside a runtime or something in order to get that level of visibility.”
Transcript evidence from Tony Turner -- Threat Modeling and SBOM.
Said by Tony Turner ·
“We have to take a risk-based approach here and understand that this lack of transparency is creating a blind spot in our risk understanding.”
Transcript evidence from Tony Turner -- Threat Modeling and SBOM.
Said by Christian Frichot ·
“What's a very HashiCorp-style way that we could help people do threat modeling?”
Transcript evidence from Christian Frichot -- Threat Modeling with hcltm.
Said by Christian Frichot ·
“It's like a specification to define somewhat programmatically a threat model and then some tooling to turn that into a human-readable file that in theory can live inside of the software repo along with the software and it can be managed with GitHub.”
Transcript evidence from Christian Frichot -- Threat Modeling with hcltm.
Said by Christian Frichot ·
“If you've worked at a handful of places and in particular organizations that have these various levels of maturity with threat modeling, no one does it the same.”
Transcript evidence from Christian Frichot -- Threat Modeling with hcltm.
Said by Zohar Shachar ·
“Getting a perspective that is only one perspective and it's partial, but turning it into the full picture is a danger that you should avoid if you run a program.”
Transcript evidence from Zohar Shachar -- Bug Bounty from Both Sides.
Said by Zohar Shachar ·
“You need to put it in a report and you need to explain it properly and you need to understand the risks behind the issue you're finding.”
Transcript evidence from Zohar Shachar -- Bug Bounty from Both Sides.
Said by Zohar Shachar ·
“You need to keep your focus on the right places, not on where the researchers focus, 'cause their motivation is different than yours.”
Transcript evidence from Zohar Shachar -- Bug Bounty from Both Sides.
Said by Sarah-jane Madden ·
“That's— and that helped me identify teams that were ripe for threat modeling because I was able to say, hey, in the past 6 months you've had this this, and this all after production, and they— that pain was always fresh with them then.”
Transcript evidence from Sarah-jane Madden -- Threat Modeling to established teams.
Said by Sarah-jane Madden ·
“Threat modeling is of such value that, it would be worthwhile to continue to evolve it.”
Transcript evidence from Sarah-jane Madden -- Threat Modeling to established teams.
Said by Sarah-jane Madden ·
“But what that showed that I think we could bring forward, pandemic aside, because remote teams have huge advantages, but was that you do need to get together for threat modeling to address creator blindness.”
Transcript evidence from Sarah-jane Madden -- Threat Modeling to established teams.
Said by Jet Anderson ·
“In order for address, for us to continue doing the job, we have to address it in a risk-based approach, identifying what should we be working on because we probably can't work on everything.”
Transcript evidence from Jet Anderson -- The AppSec Code Doctor.
Said by Jet Anderson ·
“That's why I've spent the last 5 years or so focusing on how do I engage developers to make sure that they have this information on day one and give them a direction that they can use to go and learn more.”
Transcript evidence from Jet Anderson -- The AppSec Code Doctor.
Said by Jet Anderson ·
“Then, but the last two-thirds was what are the best practices, proactive controls, like what are the things that you guys can do to make sure to do it right from the first time, from the start.”
Transcript evidence from Jet Anderson -- The AppSec Code Doctor.
Said by James Mckee ·
“We as information security professionals have to get better about pulling out the pieces of information that are right, that are important, and put the why behind it. Right. And that's the key in that space is if we can get to the why and simplify the why, the details make sense.”
Transcript evidence from James Mckee -- Developer Security.
Said by James Mckee ·
“We have to do the safety training further towards the beginning of the developer's, lifecycle as a developer.”
Transcript evidence from James Mckee -- Developer Security.
Said by James Mckee ·
“Taking, let's take some of the projects that have gone through and figure out how to create a training set specifically saying, here is a bad code, based off of a security bug, and here's how it was fixed.”
Transcript evidence from James Mckee -- Developer Security.
Said by James Mckee ·
“My genuine takeaway in all of this is go find a group of people that you're not used to talking to about security and share your passion.”
Transcript evidence from James Mckee -- Developer Security.
Said by James Mckee ·
“But what I would love to see more than that is pick one item off the OWASP Top 10 and do a deep dive. Like, if you want to, if you want to speak at a security conference, I say this as a— I'm one of the organizers of BSides Boulder, right? Like, if you want to do this, take one of those topics, dive deep, give them enough that they can take back. That's more than a blurb.”
Transcript evidence from James Mckee -- Developer Security.
Said by Derek Fisher ·
“If you are, a developer in your IDE, if you can integrate open source tools to try to detect, whether it's, whether you're running a SAST or you're running some type of open-source scanner like DependencyCheck or something like that, and if you have the ability to run some container image”
Transcript evidence from Derek Fisher -- The Application Security Handbook.
Said by Derek Fisher ·
“We, we have other words for that, whether it's paved road or golden road or guardrails.”
Transcript evidence from Derek Fisher -- The Application Security Handbook.
Said by Chris Romeo ·
“It's not about the beauty or the excellence of technical fixes or issues or architectures, I have to measure that against or weigh that against the business and say, sometimes I have to say, I'm going to have to accept that risk for a period of time, right?”
Transcript evidence from Derek Fisher -- The Application Security Handbook.
Said by Rob van der Veer ·
“You need real data by definition because you need to build it— a model based on reality needs to work in the real world.”
Transcript evidence from Rob van der Veer -- OWASP AI Security & Privacy Guide.
Said by Rob van der Veer ·
“You have to test, which is why testing is so super important.”
Transcript evidence from Rob van der Veer -- OWASP AI Security & Privacy Guide.
Said by Rob van der Veer ·
“People need to learn to get to know AI model attacks like data poisoning, input manipulation, membership inference.”
Transcript evidence from Rob van der Veer -- OWASP AI Security & Privacy Guide.
Said by Robyn Lundin ·
“The purpose that a lot of the time happens is we need to check a compliance checkbox.”
Transcript evidence from Robyn Lundin -- Planning & organizing a penetration test as an AppSec team.
Said by Robyn Lundin ·
“Spend time thinking through what am I trying to get out of this penetration test and how can I set up the people that are conducting this test for success?”
Transcript evidence from Robyn Lundin -- Planning & organizing a penetration test as an AppSec team.
Said by Chris Romeo ·
“This is a topic that we need to learn more about and have more conversations about.”
Transcript evidence from Robyn Lundin -- Planning & organizing a penetration test as an AppSec team.
Said by Michael Bargury ·
“We need to make it easy and simple for business users to make the right choice.”
Transcript evidence from Michael Bargury -- Low Code / No Code Security and an OWASP Top Ten.
Said by Michael Bargury ·
“You need to make sure when there's an application that is being used by an organization, by the organization, to make sure that the underlying connections are not somebody's personal connections.”
Transcript evidence from Michael Bargury -- Low Code / No Code Security and an OWASP Top Ten.
Said by Michael Bargury ·
“You need to understand what business users are building and try to put guardrails around it to point them in the right direction.”
Transcript evidence from Michael Bargury -- Low Code / No Code Security and an OWASP Top Ten.
Said by Michael Bargury ·
“You need to figure out which platforms your users are using and what applications they have built on top of these platforms.”
Transcript evidence from Michael Bargury -- Low Code / No Code Security and an OWASP Top Ten.
Said by Michael Bargury ·
“First of all, we need to understand as security teams that this is business, that this is critical, and this needs to fall under our umbrella.”
Transcript evidence from Michael Bargury -- Low Code / No Code Security and an OWASP Top Ten.
Said by Alex Olsen ·
“Every sprint you can revisit your threat model and then you can keep it up to date.”
Transcript evidence from Alex Olsen -- Security champions, empowering developers, and AppSec training.
Said by Alex Olsen ·
“Every development team must have an assigned security champion”
Transcript evidence from Alex Olsen -- Security champions, empowering developers, and AppSec training.
Said by Alex Olsen ·
“We do have like an open chat room where anybody can ask any questions.”
Transcript evidence from Alex Olsen -- Security champions, empowering developers, and AppSec training.
Said by Alex Olsen ·
“Security Champions should be able to, run a threat modeling session on their own, on their own.”
Transcript evidence from Alex Olsen -- Security champions, empowering developers, and AppSec training.
Said by Alex Olsen ·
“You've got to start collecting the data early.”
Transcript evidence from Alex Olsen -- Security champions, empowering developers, and AppSec training.
Said by Mark Curphey ·
“You need to think about, logging and auditing, right?”
Transcript evidence from Mark Curphey -- The future of OWASP.
Said by Mark Curphey ·
“Make sure that the community fosters and embraces the people that put the effort in.”
Transcript evidence from Mark Curphey -- The future of OWASP.
Said by Mark Curphey ·
“You can't go and create something and then hope it's going to meet people's needs.”
Transcript evidence from Mark Curphey -- The future of OWASP.
Said by Tiago Mendo ·
“We need to test still within the realm of the development team, ideally.”
Transcript evidence from Tiago Mendo -- How to scan at scale with OWASP ZAP.
Said by Tiago Mendo ·
“You need to think about ways not to interfere with your developers' working process.”
Transcript evidence from Tiago Mendo -- How to scan at scale with OWASP ZAP.
Said by Robert Hurlbut ·
“Give your developers the opportunity to recognize and prevent common and emerging security issues before they become a problem.”
Transcript evidence from Tiago Mendo -- How to scan at scale with OWASP ZAP.
Said by Wolfgang Goerlich ·
“Make sure you're putting the other person first.”
Transcript evidence from Wolfgang Goerlich -- Security beyond vulnerabilities.
Said by Wolfgang Goerlich ·
“We need to think about how the applications we're creating and the functionality we're enabling can be with legitimate functions and no use of exploits, can be used in harmful ways.”
Transcript evidence from Wolfgang Goerlich -- Security beyond vulnerabilities.
Said by Wolfgang Goerlich ·
“We need to create compelling experiences and security nudges and smart defaults that allow people to have that agency”
Transcript evidence from Wolfgang Goerlich -- Security beyond vulnerabilities.
Said by Sam Stepanyan ·
“Of course, another thing about NetTacker is you can control the speed, because the way how the scans work, it's all multi-threaded, and the user is in control of how many threads per scan you wish to use.”
Transcript evidence from Sam Stepanyan -- OWASP Nettacker Project.
Said by Sam Stepanyan ·
“Instead of saying scan one website for any vulnerabilities you can find, you say, nope, scan my entire network for one vulnerability.”
Transcript evidence from Sam Stepanyan -- OWASP Nettacker Project.
Said by Sam Stepanyan ·
“If you do have the problem in your organization that you don't know your assets, you have an asset inventory issue, all right, I would invite everyone to use NetHacker to find out the assets.”
Transcript evidence from Sam Stepanyan -- OWASP Nettacker Project.
Said by Speaker not identified ·
“Denial of service is one of the main pain points of GraphQL because the client is in control of what the response format is going to be, which is quite unique as well.”
Transcript evidence from Nick Aleks and Dolev Farhi -- GraphQL Security.
Said by Speaker not identified ·
“You have to first assume that when you deploy GraphQL, it's unprotected by default.”
Transcript evidence from Nick Aleks and Dolev Farhi -- GraphQL Security.
Said by Speaker not identified ·
“Make sure that you have the necessary tools from rate limiting perspective, from log analysis perspective, from alerting perspective that can help you get your GraphQL APIs to the level of your REST APIs.”
Transcript evidence from Nick Aleks and Dolev Farhi -- GraphQL Security.
Said by Guy Barhart-Magen ·
“Most of the appliances or systems that you're running in your business, in your enterprise, that use Log4j don't have a software bill of materials, SBOM, to tell you, this is the things that we are using, and Log4j is one of them.”
Transcript evidence from Guy Barhart-Magen -- Log4j and Incident Response.
Said by Guy Barhart-Magen ·
“This is things that you need to put in your WAF right away, that if you see a request containing these kinds of strings, block them.”
Transcript evidence from Guy Barhart-Magen -- Log4j and Incident Response.
Said by Guy Barhart-Magen ·
“I would try to do something self-hosted in this scenario.”
Transcript evidence from Guy Barhart-Magen -- Log4j and Incident Response.
Said by Guy Barhart-Magen ·
“Our recommendation at the time was focus more on mitigations, detections, because fixes will only come in at a later time.”
Transcript evidence from Guy Barhart-Magen -- Log4j and Incident Response.
Said by Guy Barhart-Magen ·
“Going back to my first sentence, consult with your IR team.”
Transcript evidence from Guy Barhart-Magen -- Log4j and Incident Response.
Said by Brett Smith ·
“You onboard them, you create attestations for them, right?”
Transcript evidence from Brett Smith -- Security is a Necessary Evil.
Said by Brett Smith ·
“We've got to verify the environment, the materials, the process, and the artifact, right?”
Transcript evidence from Brett Smith -- Security is a Necessary Evil.
Said by Brett Smith ·
“What I do is I take my SBOM and I rerun the vulnerability report against it and create a new VEX, right?”
Transcript evidence from Brett Smith -- Security is a Necessary Evil.
Said by Brett Smith ·
“Pull request runs, we get an event, the event triggers the scans, right? The scans go, and if you've got newer scanner engines, they can talk back to the pull request, and they update the pull request with the results.”
Transcript evidence from Brett Smith -- Security is a Necessary Evil.
Said by Brett Smith ·
“Once you get a secure pipeline, you should build all the tools in that pipeline with that secure pipeline, right?”
Transcript evidence from Brett Smith -- Security is a Necessary Evil.
Said by Chen Gour-Arie ·
“To build a map that helps anyone that is interested in understanding this space navigate through the different solutions that they have”
Transcript evidence from Chen Gour-Arie -- The AppSec Map.
Said by Chen Gour-Arie ·
“It's a good place to start and look for assistance, even if you are not strictly AppSec.”
Transcript evidence from Chen Gour-Arie -- The AppSec Map.
Said by Chen Gour-Arie ·
“A map approach will let you see the full scope and your alternative.”
Transcript evidence from Chen Gour-Arie -- The AppSec Map.
Said by Chen Gour-Arie ·
“You describe your asset inventory by, in a very simple way, in a very high-level way, by describing what technologies you use.”
Transcript evidence from Chen Gour-Arie -- The AppSec Map.
Said by Chen Gour-Arie ·
“You would know where you should focus, what is missing, and what should be your next steps”
Transcript evidence from Chen Gour-Arie -- The AppSec Map.
Said by Dominique Righetto ·
“For example, you deploy your application, you can use these tools to ensure that your header is still as you expected or are expected as you want.”
Transcript evidence from Dominique Righetto -- OWASP Secure Headers.
Said by Dominique Righetto ·
“In fact, Development teams, security devs can see the header as another layer of defense.”
Transcript evidence from Dominique Righetto -- OWASP Secure Headers.
Said by Dominique Righetto ·
“Then I will say discuss between the development team to see which headers are accurate for the context of the application.”
Transcript evidence from Dominique Righetto -- OWASP Secure Headers.
Said by Dominique Righetto ·
“Because when you work with header, you should work in an incremental way.”
Transcript evidence from Dominique Righetto -- OWASP Secure Headers.
Said by Hillel Solow ·
“I had the opportunity to do that a couple of times, whether it was on the cutting edge of things, so things that didn't necessarily exist and we were trying to create, Or it was, yeah, we need to encrypt our data, or we need to transmit our data encrypted, or we need to get our database encrypted, or we need to encrypt our file system.”
Transcript evidence from Hillel Solow -- How to do AppSec without a security team.
Said by Hillel Solow ·
“Then the second thing you have to keep in mind is, okay, there's some level of security that makes sense for my organization.”
Transcript evidence from Hillel Solow -- How to do AppSec without a security team.
Said by Chris Romeo ·
“Oh, you need to fix all these things before you can push to production.”
Transcript evidence from Hillel Solow -- How to do AppSec without a security team.
Said by Hillel Solow ·
“You need to make sure your cloud security is in place.”
Transcript evidence from Hillel Solow -- How to do AppSec without a security team.
Said by Chris Romeo ·
“It doesn't mean you have to go spend $1 million to build out a pipeline of security tools.”
Transcript evidence from Hillel Solow -- How to do AppSec without a security team.
Said by Chris Romeo ·
“It's a whole other thing when you're thinking about 25,000 developers that are scattered all over the earth.”
Transcript evidence from Chris Romeo -- The Security Journey Story.
Said by Chris Romeo ·
“But what you need is a good idea. You need, you need something that you stand behind, you think is going to, is going to work and is going to solve a customer's problem.”
Transcript evidence from Chris Romeo -- The Security Journey Story.
Said by Chris Romeo ·
“Get people to focus on what they're passionate about and they can help to drive wherever you want to go with the company.”
Transcript evidence from Chris Romeo -- The Security Journey Story.
Said by Speaker not identified ·
“As part of our security threat modeling process, we do ask questions about privacy as well, about privacy threats as well.”
Transcript evidence from Kristen Tan and Vaibhav Garg -- Machine Assisted Threat Modeling.
Said by Speaker not identified ·
“Then once we had this list of tools together, we had to put together a list of evaluation criteria to understand whether they were applicable for our use case And I'll highlight now, I guess, that we were looking at our use case of having this idea of putting together a privacy threat modeling”
Transcript evidence from Kristen Tan and Vaibhav Garg -- Machine Assisted Threat Modeling.
Said by Chris Romeo ·
“To summarize what I heard about the best threat modeling tool is the best threat modeling tool for your organization.”
Transcript evidence from Kristen Tan and Vaibhav Garg -- Machine Assisted Threat Modeling.
Said by Chris Romeo ·
“A lightweight software bill of materials standard designed for use in application security contexts and supply chain component analysis.”
Transcript evidence from Patrick Dwyer -- CycloneDX and SBOMs.
Said by Patrick Dwyer ·
“Go's got good inbuilt metadata capture that enables a accurate SBOM.”
Transcript evidence from Patrick Dwyer -- CycloneDX and SBOMs.
Said by Robert Hurlbut ·
“People need to get out and start looking at those dependencies.”
Transcript evidence from Patrick Dwyer -- CycloneDX and SBOMs.
Said by Speaker not identified ·
“This world of CI/CD security is so premature at the moment in most organizations that you need to start from somewhere.”
Transcript evidence from Omer Gil and Daniel Krivelevich -- Top 10 CI/CD Security Risks.
Said by Speaker not identified ·
“You need to make sure that you have this practice in place on all of your sensitive branches, in all of your sensitive repositories in your organisation.”
Transcript evidence from Omer Gil and Daniel Krivelevich -- Top 10 CI/CD Security Risks.
Said by Speaker not identified ·
“If you want to be a good defender, You have to adopt the attacker's perspective and you have to be familiar with the way attackers think.”
Transcript evidence from Omer Gil and Daniel Krivelevich -- Top 10 CI/CD Security Risks.
Said by Josh Grossman ·
“They're missing the process in between, and the people aren't sure what they're supposed to be doing because that process isn't there.”
Transcript evidence from Josh Grossman -- Building a High-Value AppSec Scanning Program.
Said by Chris Romeo ·
“If I was starting brand new today, would I buy that tool again?”
Transcript evidence from Josh Grossman -- Building a High-Value AppSec Scanning Program.
Said by Josh Grossman ·
“The amount of time you have to put into these tools is potentially higher than you'd expect.”
Transcript evidence from Josh Grossman -- Building a High-Value AppSec Scanning Program.
Said by Alex Mor ·
“In my opinion, the way of doing that is making the inventory.”
Transcript evidence from Alex Mor -- Application Risk Profiling at Scale.
Said by Alex Mor ·
“We have 4 or 5 new fields that would help us classify the risk and would help us prioritize application security engineer activities to better protect the business, to better be prepared for the attackers to come.”
Transcript evidence from Alex Mor -- Application Risk Profiling at Scale.
Said by Alex Mor ·
“We need to find the application owner, right? And ask them to update those simple questions.”
Transcript evidence from Alex Mor -- Application Risk Profiling at Scale.
Said by Alex Mor ·
“We go over those risk profiles, we go over the data, and when we prioritize what application should we pentest next, we take that list, but we don't only look at the high ones.”
Transcript evidence from Alex Mor -- Application Risk Profiling at Scale.
Said by Alex Mor ·
“First of all, make sure that what are your top-risky applications and you align that with the business, right?”
Transcript evidence from Alex Mor -- Application Risk Profiling at Scale.
Said by Brenna Leath ·
“The way that I explained the role, I have a cool PowerPoint slide that shows the liaison role of product security leads being the connection between the central product security office and our 150 to 200 security champions that we have, because we do have a security champion in each product team.”
Transcript evidence from Brenna Leath -- Product Security Leads: A different way of approaching Security Champions.
Said by Brenna Leath ·
“Different skills, which is great to see how these— we currently have 8, so how these 8 people who all have the same role, they all have to do it slightly differently because they're all in different divisions.”
Transcript evidence from Brenna Leath -- Product Security Leads: A different way of approaching Security Champions.
Said by Brenna Leath ·
“A PMP, a project management background, but it is important to know how to prioritize, how to figure out what it is you should be working on versus what people are telling you to do.”
Transcript evidence from Brenna Leath -- Product Security Leads: A different way of approaching Security Champions.
Said by Will Ratner ·
“One of the big things that we try to do, and like I've tried to do at any company, is like make it as seamless and hands-free as possible.”
Transcript evidence from Will Ratner -- Centralized container scanning.
Said by Will Ratner ·
“The big thing you can do is use multistage builds, which is super valuable, right?”
Transcript evidence from Will Ratner -- Centralized container scanning.
Said by Will Ratner ·
“I would say starting out breaking the build is not scalable, right?”
Transcript evidence from Will Ratner -- Centralized container scanning.
Said by Neil Matatall ·
“We always had to balance friction with, I guess, return.”
Transcript evidence from Neil Matatall -- AppSec at Scale.
Said by Chris Romeo ·
“You step back and you said, Hey, let's build usable security.”
Transcript evidence from Neil Matatall -- AppSec at Scale.
Said by Neil Matatall ·
“We decided to make the decision, like, you can no longer use a password we consider compromised on the site.”
Transcript evidence from Neil Matatall -- AppSec at Scale.
Said by Joern Freydank ·
“Statistically, you have to assume that one of their roles flips over or the system gets captured.”
Transcript evidence from Joern Freydank -- Security Design Anti Patterns Limit Security Debt.
Said by Joern Freydank ·
“You have to think about that, what that means if you give an admin then access to those systems that run those business functions.”
Transcript evidence from Joern Freydank -- Security Design Anti Patterns Limit Security Debt.
Said by Joern Freydank ·
“Now, the one thing though that's relatively important is that when those things are documented, those patterns, that is that you have to create an easy entry for the developers that don't have that abstraction-level knowledge.”
Transcript evidence from Joern Freydank -- Security Design Anti Patterns Limit Security Debt.
Said by Ken Toler ·
“Because blockchain is a part of the tech stack doesn't mean that it's all of the tech stack. And so there are still areas where applications are being used, APIs are being used, third-party integrations are being used, cloud infrastructure is being used, all of your containerization, all the things that we typically think of.”
Transcript evidence from Ken Toler -- Blockchain, Cloud, and #AppSec.
Said by Ken Toler ·
“These are all authorization vulnerabilities and weaknesses that happen that we would, we would consider very similar to an unprotected or unauthorized API, right? If it was a public API, we had no authorization structure, like we'd have a very similar attack.”
Transcript evidence from Ken Toler -- Blockchain, Cloud, and #AppSec.
Said by Ken Toler ·
“I think that there's still a security evaluation that needs to happen for those.”
Transcript evidence from Ken Toler -- Blockchain, Cloud, and #AppSec.
Said by Ken Toler ·
“I think what's becoming more, or what I'm realizing more and more, is the importance of threat modeling in these exercises”
Transcript evidence from Ken Toler -- Blockchain, Cloud, and #AppSec.
Said by Ken Toler ·
“One is if you're taking, if you're taking input into a contract, you should be validating it. You have similar protections around, static typing or, um, or some built-in validations in some of these languages. But you may not be able to cover all cases unless you, unless you understand your own business logic and validate what's expected.”
Transcript evidence from Ken Toler -- Blockchain, Cloud, and #AppSec.
Said by Speaker not identified ·
“Use a specialized tool for the job, any secrets manager, even a password manager if it's for your personal secrets, for example, use something like 1Password, LastPass, whatnot, KeePass.”
Transcript evidence from Jeroen Willemsen and Ben de Haan -- Dirty little secrets.
Said by Speaker not identified ·
“Ensure that every secret has a certain blast radius.”
Transcript evidence from Jeroen Willemsen and Ben de Haan -- Dirty little secrets.
Said by Speaker not identified ·
“Making things temporal and using temporary credentials. is important.”
Transcript evidence from Jeroen Willemsen and Ben de Haan -- Dirty little secrets.
Said by Speaker not identified ·
“Make sure your secrets management is part of a threat model.”
Transcript evidence from Jeroen Willemsen and Ben de Haan -- Dirty little secrets.
Said by Speaker not identified ·
“Make sure you can log when somebody accessed the secret and make sure you can understand who that was.”
Transcript evidence from Jeroen Willemsen and Ben de Haan -- Dirty little secrets.
Said by Adam Shostack ·
“We discover if we find bad things, and if we're finding some bad things that we wouldn't otherwise have found, then that's good.”
Transcript evidence from Adam Shostack -- Fast, cheap and good threat models.
Said by Chris Romeo ·
“There's nothing— there's no better future that I can think of than the threat modeling process doesn't even exist anymore because it's ingrained in how we build software.”
Transcript evidence from Adam Shostack -- Fast, cheap and good threat models.
Said by Chris Romeo ·
“Translating the ASVS requirement into a threat and saying, for those people that are new to this and they don't have the mental models of all the things that we've done where we've seen different threats, and so we can see them jump off the page.”
Transcript evidence from Adam Shostack -- Fast, cheap and good threat models.
Said by Loren Kohnfelder ·
“But then I flip that back around and see that security measures can often get in the way or they can complicate it or they can make the user experience miserable.”
Transcript evidence from Loren Kohnfelder -- Designing Secure Software.
Said by Loren Kohnfelder ·
“When there's a design that's fully formed, short of final, it's great to review it.”
Transcript evidence from Loren Kohnfelder -- Designing Secure Software.
Said by Loren Kohnfelder ·
“Fairly short, gives you a broad overview of the field, because we want to get a lot of, uh, people connected to software, working on it, not developers, but all the people around them, user interface managers, We want them to have some intuition about what these problems are and what— how we have to deal with them”
Transcript evidence from Loren Kohnfelder -- Designing Secure Software.
Said by Ochaun Marshall ·
“The whole point of being able to have the configuration files to spin up and build the infrastructure in the first place is so that you can delete it, you can tear down, you modify it and have a centralized location and know what and know how it, what it, how it connects to other resource cloud resources.”
Transcript evidence from Ochaun Marshall -- IaC and SAST.
Said by Ochaun Marshall ·
“The SAST is a starting point in which you can make some initial investigation because any static analysis tool will need multiple runs and will need configuration changes as well.”
Transcript evidence from Ochaun Marshall -- IaC and SAST.
Said by Ochaun Marshall ·
“I will say SAST is nowhere in a security program if it takes excess of 10 minutes and thousands of dollars per each run and per each scan.”
Transcript evidence from Ochaun Marshall -- IaC and SAST.
Said by Simon Bennetts ·
“It's a good idea because ZAP is free It means you can use ZAP as you're developing your application, and you can use ZAP to find vulnerabilities before you get the pen testers involved.”
Transcript evidence from Simon Bennetts -- Using OWASP Zap across an Enterprise.
Said by Simon Bennetts ·
“OWASP's got some great documentation projects that you should definitely check out if you haven't already.”
Transcript evidence from Simon Bennetts -- Using OWASP Zap across an Enterprise.
Said by Simon Bennetts ·
“The whole idea of the HUD was that we wanted people to be able to focus more on the target application than on the security tools app.”
Transcript evidence from Simon Bennetts -- Using OWASP Zap across an Enterprise.
Said by Timo Pagel ·
“You need to understand the underlying technology.”
Transcript evidence from Timo Pagel -- DevSecOps Maturity Model.
Said by Timo Pagel ·
“You choose which teams you would like to interview because they might use different technologies”
Transcript evidence from Timo Pagel -- DevSecOps Maturity Model.
Said by Timo Pagel ·
“You need to make sure that you're executing JavaScript nowadays because not every scanner will automatically do that”
Transcript evidence from Timo Pagel -- DevSecOps Maturity Model.
Said by Mazin Ahmed ·
“But the reality is it's a lot of the things, there are a lot of things that you would have to manage and secure and scan, monitor, and configure to be in a typical secure environment, not the highest security.”
Transcript evidence from Mazin Ahmed -- Terraform Security.
Said by Mazin Ahmed ·
“Once you have that, then you have a full archive of everything that happens into your cloud environment.”
Transcript evidence from Mazin Ahmed -- Terraform Security.
Said by Mazin Ahmed ·
“The first thing to start with is learning about all of the attacks and all of the vectors. all of the threats that using Terraform can bring to the organization.”
Transcript evidence from Mazin Ahmed -- Terraform Security.
Said by Speaker not identified ·
“That's what we talk about because ultimately these folks that are in these teams should strive to be— that should be their pipeline to be architects over time.”
Transcript evidence from James Ransome and Brook Schoenfield -- trust and verify: Building in Security at Agile Speed.
Said by Speaker not identified ·
“That's how you build, and the people who are moving to the upper echelons must, they're required to train skills.”
Transcript evidence from James Ransome and Brook Schoenfield -- trust and verify: Building in Security at Agile Speed.
Said by Speaker not identified ·
“I think in order to ensure that security is cohesively blended into DevOps, pen testing should be performed on an ongoing basis to keep up with it.”
Transcript evidence from James Ransome and Brook Schoenfield -- trust and verify: Building in Security at Agile Speed.
Said by Chris Romeo ·
“With that, it takes us to A4 for 2021, insecure design, the one that causes all of us threat modeling people to run around and dance and jump up and down and be so happy and excited because If you have a flaw of insecure design, you're going to have to have a preventative measure of threat modeling.”
Transcript evidence from OWASP Top 10 2021 Peer Review.
Said by Chris Romeo ·
“I love this set of questions right here, that developers should be asking themselves as they're thinking about, their use of crypto.”
Transcript evidence from OWASP Top 10 2021 Peer Review.
Said by Chris Romeo ·
“Review it, add comments to it, do pull requests, like give back to your community.”
Transcript evidence from OWASP Top 10 2021 Peer Review.
Said by Anastasiia Voitova ·
“It's important that application encrypts the data before it sends through the network, through the servers, and the backend doesn't have decryption keys.”
Transcript evidence from Anastasiia Voitova -- Encryption is easy, key management is hard.
Said by Anastasiia Voitova ·
“We can use different ciphers to decrease security guarantees but increase ability to search.”
Transcript evidence from Anastasiia Voitova -- Encryption is easy, key management is hard.
Said by Anastasiia Voitova ·
“The trade-off is to build a system that gives good enough security guarantees, but it's not catastrophic in terms of all these additional layers we need to build to make key management secure.”
Transcript evidence from Anastasiia Voitova -- Encryption is easy, key management is hard.
Said by Eran Kinsbruner ·
“Doing more security testing and validation earlier in the dev cycle, right?”
Transcript evidence from Eran Kinsbruner -- DevSecOps Continuous Testing.
Said by Eran Kinsbruner ·
“The ability to automate the process of security, uh, validation as part of, coding.”
Transcript evidence from Eran Kinsbruner -- DevSecOps Continuous Testing.
Said by Eran Kinsbruner ·
“Every pull request you consider and think about what it means for— from a security standpoint.”
Transcript evidence from Eran Kinsbruner -- DevSecOps Continuous Testing.
Said by Mark Loveless ·
“It's like we're going to have to come up with some type of system where it's got to integrate in with what they're doing already.”
Transcript evidence from Mark Loveless -- Threat modeling in a DevSecOps environment..
Said by Mark Loveless ·
“We've been stepping through this with some of the other sub-departments, like say the compliance people, they have to do evaluations of a product that we're bringing in, like, well, let's threat model that.”
Transcript evidence from Mark Loveless -- Threat modeling in a DevSecOps environment..
Said by Mark Loveless ·
“One of our guys, he said, yeah, I can help you with this and let's do a quick threat model.”
Transcript evidence from Mark Loveless -- Threat modeling in a DevSecOps environment..
Said by Jeroen Willemsen ·
“Start having a look at your dependencies with open source tooling like the OWASP Dependency Checker”
Transcript evidence from Jeroen Willemsen -- Security automation with ci/cd.
Said by Jeroen Willemsen ·
“Automation gives you a lot of data, not necessarily information.”
Transcript evidence from Jeroen Willemsen -- Security automation with ci/cd.
Said by Jeroen Willemsen ·
“Find teams that you can collaborate with to develop those parts of the pipeline in a way that it's sensible for the developers.”
Transcript evidence from Jeroen Willemsen -- Security automation with ci/cd.
Said by Jeroen Willemsen ·
“Make sure that you secure the pipeline that you use to use these tools.”
Transcript evidence from Jeroen Willemsen -- Security automation with ci/cd.
Said by Chris Romeo ·
“Understand the pipeline, understand what you're putting people through”
Transcript evidence from Jeroen Willemsen -- Security automation with ci/cd.
Said by Robert Hurlbut ·
“We have to get developers better option as it relates to software.”
Transcript evidence from Thinking back, Looking forward - A Balanced Approach to Securing our Software Future.
Said by Robert Hurlbut ·
“We have to get back to sound fundamental software engineering principles where software minimalism is important”
Transcript evidence from Thinking back, Looking forward - A Balanced Approach to Securing our Software Future.
Said by Robert Hurlbut ·
“We have to make sure not to automate badness.”
Transcript evidence from Thinking back, Looking forward - A Balanced Approach to Securing our Software Future.
Said by Jeevan Singh ·
“Continue to create the threat modeling tickets and make sure you attach the artifacts after you've threat modeled.”
Transcript evidence from Jeevan Singh -- Threat modeling based in democracy.
Said by Jeevan Singh ·
“We'll, we'll have a once over, make sure everything we should be threat modeling or reviewing this particular design.”
Transcript evidence from Jeevan Singh -- Threat modeling based in democracy.
Said by Jeevan Singh ·
“Now it's mostly been engineering-led because we're trying to make sure that they are trained in the right fashion for doing the threat models themselves.”
Transcript evidence from Jeevan Singh -- Threat modeling based in democracy.
Said by Dima Kotik ·
“The 4 basic principles are that excellent Pythonic code should be readable, explicit, simple, and singular.”
Transcript evidence from Dima Kotik -- Application Security and the Zen of Python.
Said by Dima Kotik ·
“Don't write functions that ignore error or the infamous, try-catch block with the catch part empty,”
Transcript evidence from Dima Kotik -- Application Security and the Zen of Python.
Said by Dima Kotik ·
“Don't write— if you have a function that does 2 things, has a boolean parameter, okay, that needs to be split up.”
Transcript evidence from Dima Kotik -- Application Security and the Zen of Python.
Said by Dustin Lehr ·
“One of the big things that I did as an architect was, frankly, trying to document and capture the tech debt that we had for particular systems and start to pick those off, even so far as working with the business to try to allocate some time every single sprint to work on the technical debt.”
Transcript evidence from Dustin Lehr -- Advocating and being on the side of developers.
Said by Dustin Lehr ·
“I wouldn't necessarily put a barrier up and say, if you don't have coding skills, you can't be part of the team.”
Transcript evidence from Dustin Lehr -- Advocating and being on the side of developers.
Said by Dustin Lehr ·
“Let's work together and get there together.”
Transcript evidence from Dustin Lehr -- Advocating and being on the side of developers.
Said by Dustin Lehr ·
“Start by automating the scans that you run, whether it's SAST or IAST, et cetera.”
Transcript evidence from Dustin Lehr -- Advocating and being on the side of developers.
Said by Dustin Lehr ·
“I would say that, let's, call to action would be work hard, make sure that you are being an advocate for your developers and you're evaluating tools, that are going to work best for them.”
Transcript evidence from Dustin Lehr -- Advocating and being on the side of developers.
Said by Aaron Rinehart ·
“What we're doing fundamentally with security chaos engineering is we're asking the security mechanisms, are you doing what you're supposed to do?”
Transcript evidence from Aaron Rinehart -- Security Chaos Engineering.
Said by Aaron Rinehart ·
“It constantly has to be recalibrated to meet the conditions of the system, and we're not doing that.”
Transcript evidence from Aaron Rinehart -- Security Chaos Engineering.
Said by Aaron Rinehart ·
“It's best done in a game day exercise.”
Transcript evidence from Aaron Rinehart -- Security Chaos Engineering.
Said by Aaron Rinehart ·
“You want to hook into some KPI with the control.”
Transcript evidence from Aaron Rinehart -- Security Chaos Engineering.
Said by Aaron Rinehart ·
“It's better to continuously run it on its own schedule and inform you than run from CI/CD.”
Transcript evidence from Aaron Rinehart -- Security Chaos Engineering.
Said by Speaker not identified ·
“I want to take this threat modeling thing away from the security sphere and get it in the hands of the people that we want to use it.”
Transcript evidence from Izar Tarandach and Matt Coles-- Threat Modeling: A Practical Guide for Development Teams.
Said by Speaker not identified ·
“The people who have to have the basic learning and understanding of what threat modeling is, what it represents, and what it can give you, must be the developer.”
Transcript evidence from Izar Tarandach and Matt Coles-- Threat Modeling: A Practical Guide for Development Teams.
Said by Speaker not identified ·
“You have a need to make sure that those folks are educated enough to be able to have a good conversation.”
Transcript evidence from Izar Tarandach and Matt Coles-- Threat Modeling: A Practical Guide for Development Teams.
Said by Charles Shirer ·
“If you're in a position where you're not doing what you love right now, work towards doing something that you love.”
Transcript evidence from Charles Shirer -- The most positive person in security.
Said by Charles Shirer ·
“The key is how you approach it. Because again, you still got to face the problem, but do you want to face it in a negative attitude or do you want to keep it in a positive light? That's the choice that you control.”
Transcript evidence from Charles Shirer -- The most positive person in security.
Said by Charles Shirer ·
“If you're feeling burned out, take a break. It could be your favorite television show. Take like 30 minutes if you need to, or if you want to go see something outside, take a walk outside, but fixate your mind on something that you enjoy for like, for like 30 minutes.”
Transcript evidence from Charles Shirer -- The most positive person in security.
Said by Charles Shirer ·
“I may not do— I may not be able to do what you can do right now, but I guarantee you, if I, if I stick around and keep working at it, I will get there.”
Transcript evidence from Charles Shirer -- The most positive person in security.
Said by Charles Shirer ·
“Even if it's taking the first step of asking the question. That's a step towards the right direction. Hey, how do I do this? I guarantee you, there's someone out there that's willing to help you.”
Transcript evidence from Charles Shirer -- The most positive person in security.
Said by Leif Dreizler ·
“If security is bought into what engineering is doing and understands how engineers build stuff, when you as a security person are reviewing something or providing feedback, you're gonna be much more likely to be able to provide feedback that makes sense.”
Transcript evidence from Leif Dreizler -- Tactical tips to shift engineering right.
Said by Leif Dreizler ·
“That naturally makes security something that you need to invest in more heavily because otherwise, your big customers are going to be like, we don't trust you, so we're not going to give you millions of dollars.”
Transcript evidence from Leif Dreizler -- Tactical tips to shift engineering right.
Said by Leif Dreizler ·
“It's something that you have to start out a little bit more formal.”
Transcript evidence from Leif Dreizler -- Tactical tips to shift engineering right.
Said by Leif Dreizler ·
“Make sure that the tests capture it, make sure that somebody reviews the pull request, they come up with a better way for you to do it?”
Transcript evidence from Leif Dreizler -- Tactical tips to shift engineering right.
Said by Vandana Verma ·
“The first thing I did was made a list of different projects which are part of OWA's flagship projects, lab projects, and then picked up from the incubator projects which are active at the moment.”
Transcript evidence from Vandana Verma -- OWASP Spotlight Series.
Said by Vandana Verma ·
“Understand what exactly is your need, go with the open source project which is there already, and start building on top of it.”
Transcript evidence from Vandana Verma -- OWASP Spotlight Series.
Said by Vandana Verma ·
“Go check out the project that might interest you the most.”
Transcript evidence from Vandana Verma -- OWASP Spotlight Series.
Said by Anita D’Amico ·
“We need to put together an integrated product team, an IPT.”
Transcript evidence from Dr. Anita D’Amico -- Do certain types of developers or teams write more secure code?.
Said by Anita D’Amico ·
“You have to focus your attention on one or two things, or else your code is going to suffer.”
Transcript evidence from Dr. Anita D’Amico -- Do certain types of developers or teams write more secure code?.
Said by Anita D’Amico ·
“Try not to have more than 9 developers on one thing.”
Transcript evidence from Dr. Anita D’Amico -- Do certain types of developers or teams write more secure code?.
Said by Alyssa Miller ·
“DevOps is about a culture where everybody has a shared responsibility for ensuring that the software that gets deployed is stable, it's deployed efficiently, and it's secure.”
Transcript evidence from Alyssa Miller -- Bringing security to DevOps and the CI/CD pipeline.
Said by Alyssa Miller ·
“If I'm building a CI/CD pipeline, I should be building in that measurability.”
Transcript evidence from Alyssa Miller -- Bringing security to DevOps and the CI/CD pipeline.
Said by Alyssa Miller ·
“If you don't understand those things, start studying.”
Transcript evidence from Alyssa Miller -- Bringing security to DevOps and the CI/CD pipeline.
Said by Alyssa Miller ·
“The concept is getting to this point where security is not a gate between phases, it's integrated into the phases.”
Transcript evidence from Alyssa Miller -- Bringing security to DevOps and the CI/CD pipeline.
Said by Liran Tal ·
“You need to think of scale, of how do you adapt to those areas?”
Transcript evidence from Liran Tal — Cloud native application security, what’s a developer to do?.
Said by Liran Tal ·
“Use a digest because you don't want to always pull latest versions of packages.”
Transcript evidence from Liran Tal — Cloud native application security, what’s a developer to do?.
Said by Liran Tal ·
“You offload it to Okta, Auth0, whatever, all of those things that help you do it because you understand they have solved the problem and you need to get your app working in that function.”
Transcript evidence from Liran Tal — Cloud native application security, what’s a developer to do?.
Said by Chris Romeo ·
“We as security people have to start seeing things through the eyes of the people we're trying to help and we're trying to influence.”
Transcript evidence from Chris Romeo — DevSecOps Fails.
Said by Chris Romeo ·
“Don't fall into that trap of saying you've got to do everything now.”
Transcript evidence from Chris Romeo — DevSecOps Fails.
Said by Chris Romeo ·
“Work with the team to get the pipeline set up to the point where you've got the security tools you need to gain the assurance about the build, so then you can move at DevOps speed.”
Transcript evidence from Chris Romeo — DevSecOps Fails.
Said by Jim Routh ·
“The answer to your question is the one aspect of a software security transformation that's often ignored— there's people involved and people have to change behavior, and those softer skills in terms of behavior change are essential to any software security program success.”
Transcript evidence from Jim Routh — Secure software pipelines.
Said by Jim Routh ·
“If you're highly skilled as a software developer, you have to learn additive skills to configure the packaging of the build, where all of that is provided for you in the on-prem world.”
Transcript evidence from Jim Routh — Secure software pipelines.
Said by Jim Routh ·
“You have to recognize that there's nothing like— perfection is not a word that belongs in a sentence that involves software development, right?”
Transcript evidence from Jim Routh — Secure software pipelines.
Said by Jim Routh ·
“Every DevOps organization should consider playing with some of the technology.”
Transcript evidence from Jim Routh — Secure software pipelines.
Said by Andrew van der Stock ·
“The reality is it's an education piece and it makes people aware of the issues, but it's not meant be a standard.”
Transcript evidence from Andrew van der Stock — Taking Application Security to the Masses.
Said by Andrew van der Stock ·
“We should be encouraging frameworks and developers to choose safer practices at all times.”
Transcript evidence from Andrew van der Stock — Taking Application Security to the Masses.
Said by Andrew van der Stock ·
“Come to the chapter meetings, get involved with projects.”
Transcript evidence from Andrew van der Stock — Taking Application Security to the Masses.
Said by Speaker not identified ·
“Now we have to get away from this business of open source versus proprietary because open source is in everything.”
Transcript evidence from JC Herz and Steve Springett — SBOMs and software supply chain assurance.
Said by Speaker not identified ·
“If we are serious about supply chain, which is in the news and an issue for all kinds of reasons related to telecommunications and other things, we need to start to understand the quality and the maintenance histories of what we're using and whether those things are defective or whether they're vulnerable or whether they're actively maintained.”
Transcript evidence from JC Herz and Steve Springett — SBOMs and software supply chain assurance.
Said by Speaker not identified ·
“Without the full SBOM, and we're looking for that full, not only my direct dependencies, but my, all of my transitive dependencies and all of my runtime and environmental dependencies as well.”
Transcript evidence from JC Herz and Steve Springett — SBOMs and software supply chain assurance.
Said by Brian Reed ·
“Sourmint is that example of make sure you choose carefully for your third-party libraries, right?”
Transcript evidence from Brian Reed — Mobile Appsec: The Good, the Bad and the Ugly as We Head into 2021.
Said by Brian Reed ·
“If you're on the developer side, download and read the MASVS from OWASP, and if you're on the tester side, download and read the MSTG.”
Transcript evidence from Brian Reed — Mobile Appsec: The Good, the Bad and the Ugly as We Head into 2021.
Said by Brian Reed ·
“Thinking about how secure mobile development best practices are gonna be shared and learned with your development team is very important.”
Transcript evidence from Brian Reed — Mobile Appsec: The Good, the Bad and the Ugly as We Head into 2021.
Said by Brian Reed ·
“Do the appropriate level of threat modeling and risk modeling in your mobile apps, and then make sure you're building in the right testing strategy.”
Transcript evidence from Brian Reed — Mobile Appsec: The Good, the Bad and the Ugly as We Head into 2021.
Said by Brian Reed ·
“On mobile, you need to test the binary, not the source.”
Transcript evidence from Brian Reed — Mobile Appsec: The Good, the Bad and the Ugly as We Head into 2021.
Said by Chris Romeo ·
“At the highest levels, when we threat model, we ask 4 key questions. 1, what are we working on? 2, what can go wrong? 3, what are we going to do about it? And 4, did we do a good enough job?”
Transcript evidence from The Threat Modeling Manifesto – Part 2.
Said by Chris Romeo ·
“We wanted to have the Threat Modeling Manifesto be something that could be printed on a poster, a one-page poster, and hung up on the wall inside of a company somewhere, because here's what we're gonna drive towards as we're doing threat modeling.”
Transcript evidence from The Threat Modeling Manifesto – Part 2.
Said by Robert Hurlbut ·
“We have come to value a culture of finding and fixing design issues over checkbox compliance.”
Transcript evidence from The Threat Modeling Manifesto – Part 2.
Said by Robert Hurlbut ·
“Threat modeling must align with an organization's development practices and follow design changes in iterations that are each scoped to manageable portions of the system.”
Transcript evidence from The Threat Modeling Manifesto – Part 2.
Said by Chris Romeo ·
“Dialogue is key to establishing the common understandings that lead to value, while documents record those understandings and enable measurement.”
Transcript evidence from The Threat Modeling Manifesto – Part 2.
Said by Robert Hurlbut ·
“Their goal was to create a definition for threat modeling to encourage people to threat model and help them succeed.”
Transcript evidence from The Threat Modeling Manifesto – Part 1.
Said by Robert Hurlbut ·
“The Threat Modeling Manifesto Working Group contains some of the biggest names from the corporate and academic worlds.”
Transcript evidence from The Threat Modeling Manifesto – Part 1.
Said by Chris Romeo ·
“The first 3 principles to be starting to threat model.”
Transcript evidence from The Threat Modeling Manifesto – Part 1.
Said by Robert Hurlbut ·
“This is like a theoretical structure, but you have to apply to a particular context of your organization.”
Transcript evidence from Season 7 Guests — The best of Season 7.
Said by Robert Hurlbut ·
“We do care about the language because we need to understand the syntax of the language.”
Transcript evidence from Season 7 Guests — The best of Season 7.
Said by Robert Hurlbut ·
“We need to take care about users' data more and more and more.”
Transcript evidence from Season 7 Guests — The best of Season 7.
Said by Aviat Jean-Baptiste ·
“Obviously, We shared the data with the OWASP as well.”
Transcript evidence from Aviat Jean-Baptiste — The AppSec report.
Said by Aviat Jean-Baptiste ·
“If some of those applications are not using frameworks, probably you should put them on top of your list, and you should have monitoring or protections on top of that.”
Transcript evidence from Aviat Jean-Baptiste — The AppSec report.
Said by Aviat Jean-Baptiste ·
“I think having a data-driven decision model to help a given team implement CI, to put more runtime protections on your applications, to build your security strategy JB, thanks for taking the time to share this report with us and explain many of the different pieces of the report.”
Transcript evidence from Aviat Jean-Baptiste — The AppSec report.
Said by Frank Rietta ·
“In practice, there's time to market and cost-benefit analysis, but I still believe firmly you have to build security in.”
Transcript evidence from Frank Rietta — The convergence of Ruby on Rails and #AppSec.
Said by Robert Hurlbut ·
“If somebody chooses to turn it off, but it should be turned on by default.”
Transcript evidence from Frank Rietta — The convergence of Ruby on Rails and #AppSec.
Said by Frank Rietta ·
“Then run— set up your pipeline to run, Breakman, to run Bundler Audit.”
Transcript evidence from Frank Rietta — The convergence of Ruby on Rails and #AppSec.
Said by Frank Rietta ·
“But what I encourage you to do Is to think about the things that could go wrong and to write a test for that.”
Transcript evidence from Frank Rietta — The convergence of Ruby on Rails and #AppSec.
Said by Frank Rietta ·
“If the first time that you are thinking about security is when you hire an external pen test firm, you are doing it wrong.”
Transcript evidence from Frank Rietta — The convergence of Ruby on Rails and #AppSec.
Said by Dmitry Sotnikov ·
“I had a basic understanding that you should obviously, like, your cloud environment should be secured, you should have the lowest possible permissions everywhere, you don't store your keys where they can be grasped, don't put them in code.”
Transcript evidence from Dmitry Sotnikov – REST API Security – there is no silver bullet.
Said by Dmitry Sotnikov ·
“I think number one thing is to make sure that all the APIs that get spun up are controlled, whatever you have, your CI/CD process or some other process that would discover all the APIs and you have a good grasp of the APIs that you have.”
Transcript evidence from Dmitry Sotnikov – REST API Security – there is no silver bullet.
Said by Dmitry Sotnikov ·
“I guess I think the biggest takeaway is that APIs are a real security threat, real attack vector.”
Transcript evidence from Dmitry Sotnikov – REST API Security – there is no silver bullet.
Said by Caroline Wong ·
“Then, not only might you incorporate some automated testing into a regression test to try and eliminate that from coming up in future iterations, but putting a step earlier in the process to try and prevent it from being created in the first place.”
Transcript evidence from Caroline Wong — The state of Penetration Testing.
Said by Caroline Wong ·
“For example, Cobalt works with some clients that have us come in and do a pen test every month, and they're like relatively small pen tests.”
Transcript evidence from Caroline Wong — The state of Penetration Testing.
Said by Caroline Wong ·
“One of them, which we talked about a little bit, but I want to go into a nuance of it, is that identifying a vulnerability is not the same as assessing the risk that it presents.”
Transcript evidence from Caroline Wong — The state of Penetration Testing.
Said by Aaron Davis ·
“Without changing how your code works at all, you run it in a way that applies a little sandbox around each package or module based on a policy file.”
Transcript evidence from Aaron Davis — LavaMoat — solving JavaScript software supply chain.
Said by Aaron Davis ·
“The best part is if the security guarantees, espousing LavaMoat provides, even if there was a flaw found that tears away all the security, you're back to where you are today.”
Transcript evidence from Aaron Davis — LavaMoat — solving JavaScript software supply chain.
Said by Aaron Davis ·
“Once you've disabled that, on your build server or on your personal development machine, then you want to move on to moving your builds, your build server, or a server if you're running Node stuff, in Lava Mode Node.”
Transcript evidence from Aaron Davis — LavaMoat — solving JavaScript software supply chain.
Said by Anastasiia Voitova ·
“What those potential product managers don't know is about technical data, which needs to be protected. All these accesses, keys, logs, all the things, right?”
Transcript evidence from Anastasiia Voitova — Use Cryptography; Don’t Learn It.
Said by Anastasiia Voitova ·
“There are already libraries that give you like one-line API with like one or two parameters, data and key, and it's all good.”
Transcript evidence from Anastasiia Voitova — Use Cryptography; Don’t Learn It.
Said by Anastasiia Voitova ·
“Key generation, key rotation, key revocation, key expiration, key sharing. All these things you kinda need to think about in your system and build in from day zero Or at least think about it, how you will handle it.”
Transcript evidence from Anastasiia Voitova — Use Cryptography; Don’t Learn It.
Said by Anastasiia Voitova ·
“First of all, I would say that take a look on this native platform libraries available for your language or for your technical stack and look on which ciphers this library provides. And if it provides old ciphers, that's like a question mark, right?”
Transcript evidence from Anastasiia Voitova — Use Cryptography; Don’t Learn It.
Said by Anastasiia Voitova ·
“I would say try to use boring tools, right? Instead of spending time on learning cryptography or figuring out how to use, like, how to do your things with normal, I don't know, cryptographic tools, or like usual, better spend this time trying to find the boring tool because this will save your time later during implementation, during testing, or even save you from security mistakes and potential vulnerabilities.”
Transcript evidence from Anastasiia Voitova — Use Cryptography; Don’t Learn It.
Said by Michael Furman ·
“Secure attribute means that a cookie will be sent only over HTTPS channel.”
Transcript evidence from Michael Furman — SameSite Cookies.
Said by Michael Furman ·
“CSRF, it's a very problematic and very dangerous attack that should be prevented.”
Transcript evidence from Michael Furman — SameSite Cookies.
Said by Michael Furman ·
“You need to use same-site because same-site is simpler.”
Transcript evidence from Michael Furman — SameSite Cookies.
Said by Michael Furman ·
“It provides very good level of security and you don't have a very serious UX impact”
Transcript evidence from Michael Furman — SameSite Cookies.
Said by Michael Furman ·
“You need to use it only in case of very sensitive application.”
Transcript evidence from Michael Furman — SameSite Cookies.
Said by Chris Romeo ·
“I would ensure that you are dialed in with the providers of your infrastructure and that, if there is a vulnerability that exists in one of those things, you are taking advantage of the information feeds that those companies provide.”
Transcript evidence from Chris Romeo — The State of Security and the Importance of Empathy.
Said by Robert Hurlbut ·
“You absolutely can do everything with 2 approvals and use Git, use GitFlow, use whatever, but the tools are there.”
Transcript evidence from Chris Romeo — The State of Security and the Importance of Empathy.
Said by Chris Romeo ·
“I'm going to walk a day in the shoes of the developer so that I can understand the challenges they have.”
Transcript evidence from Chris Romeo — The State of Security and the Importance of Empathy.
Said by Neil Matatall ·
“Its primary purpose is to govern what resources can load on a given page or what content can execute in the context of a given page load inside of a browser.”
Transcript evidence from Neil Matatall — Content Security Policy.
Said by Neil Matatall ·
“I think crawl your site, try to hit the deepest, darkest corners of your website, modify your policy as you go along.”
Transcript evidence from Neil Matatall — Content Security Policy.
Said by Neil Matatall ·
“If this is— and this is a true story— one of the first ones I did had one page that had a WYSIWYG editor that needed unsafe-inline and unsafe-eval, but enabling that for the entire application was wrong because it didn't need that anywhere else.”
Transcript evidence from Neil Matatall — Content Security Policy.
Said by Grant Ongers ·
“Security is something that should be built into your product from the beginning.”
Transcript evidence from Grant Ongers — Gamification of threat modeling.
Said by Grant Ongers ·
“Security is, according to the ISO 25000 standard, an aspect of the quality of software.”
Transcript evidence from Grant Ongers — Gamification of threat modeling.
Said by Grant Ongers ·
“You can't bolt security on or bolt quality onto anything at the end of building it.”
Transcript evidence from Grant Ongers — Gamification of threat modeling.
Said by Elie Saad ·
“How is a developer looking at my recommendations And how can I make my recommendations more developer-friendly?”
Transcript evidence from Elie Saad — OWASP WSTG, Cheat Sheets, and Integration.
Said by Elie Saad ·
“OWASP is the almighty knowledge base of application security, whether it was with tooling, documentation, requirements, all of these things.”
Transcript evidence from Elie Saad — OWASP WSTG, Cheat Sheets, and Integration.
Said by Elie Saad ·
“When you look for a certain piece of code and you don't see the best practice being applied, then it means there's something wrong happening there.”
Transcript evidence from Elie Saad — OWASP WSTG, Cheat Sheets, and Integration.
Said by Graham Holmes ·
“My role was to, during this transition period of building these things secretly, was to compel developers to make changes in their code base that they didn't understand why we were doing it and what the outcome was and convince them that we need to keep this very quiet, close— closely held until the solution was out there so that we could then announce to our customers what we had done to mitigate the problem.”
Transcript evidence from Graham Holmes — Adversarial Machine Learning.
Said by Graham Holmes ·
“As the machine learning system is trained, that's— you have to start with a data training set, say, here's how to classify good data and here's how to classify bad data.”
Transcript evidence from Graham Holmes — Adversarial Machine Learning.
Said by Graham Holmes ·
“Think about business systems that you might have in your network that require a lot of interaction with humans to look at the data, to take an action, and to make a decision.”
Transcript evidence from Graham Holmes — Adversarial Machine Learning.
Said by Robert Hurlbut ·
“We have to go to them and go to their conferences and educate them versus saying, well, they should all come to security conferences.”
Transcript evidence from Ochaun Marshall — Securing Web applications in AWS.
Said by Ochaun Marshall ·
“We have to build from scratch, simply for not for billing reasons, but to understand, to understand the risks and the complications in an AWS environment.”
Transcript evidence from Ochaun Marshall — Securing Web applications in AWS.
Said by Robert Hurlbut ·
“You have to do things manually enough so you're in so much pain that automating makes the— takes away the pain.”
Transcript evidence from Ochaun Marshall — Securing Web applications in AWS.
Said by Drew Dennison ·
“I want to audit all my codebase of where people are doing authentication, but it's happening outside the trusted path.”
Transcript evidence from Drew Dennison – Security should make the computer sweat more.
Said by Drew Dennison ·
“I think the use case that we've been using internally is either as a pre-commit hook, which has worked quite well, or a GitHub Action, or a CircleCI, where you're like, hey, as long as it finishes in less than 3 or 4 minutes, totally fine.”
Transcript evidence from Drew Dennison – Security should make the computer sweat more.
Said by Drew Dennison ·
“It is going to show you the findings that are in that 15 lines of code or whatever you submitted as part of that pull request, which I think is nice because then you're like, oh, yeah, or I disagree with the tool and I want to archive it and be like, add that to the whitelist file.”
Transcript evidence from Drew Dennison – Security should make the computer sweat more.
Said by Drew Dennison ·
“Show me across all my codebases, what are the routes that have any authorization, or more interestingly, which ones don't have any authorization at all?”
Transcript evidence from Drew Dennison – Security should make the computer sweat more.
Said by Drew Dennison ·
“Let the computer do that work, find the hotspots, and then, you tell the developer directly, you send a Slack notification or open a Jira issue to the security team, and then they're going to go through and apply their intelligence.”
Transcript evidence from Drew Dennison – Security should make the computer sweat more.
Said by Aaron Guzman ·
“2 is if you want to statically analyze the firmware, you can download the Raspberry Pi, use something like binwalk to extract the firmware file system, And from there analyze the file system contents for vulnerabilities, look at the configurations, check for, any web pages that let's say aren't”
Transcript evidence from Aaron Guzman — IoTGoat.
Said by Chris Romeo ·
“One way would be to download the VirtualBox or virtual VMware version of the image, run that, set up a virtual machine on my computer, start it, and then effectively that virtual machine is emulating what an IoT device would look like. if it was sitting on the network.”
Transcript evidence from Aaron Guzman — IoTGoat.
Said by Aaron Guzman ·
“IoT Goat is one tool or platform to accomplish that goal, in addition to, the test— the firmware security testing guide and the Security Verification Center we're working on.”
Transcript evidence from Aaron Guzman — IoTGoat.
Said by Adam Shostack ·
“There are 3 types of blocks in this metaphor. There's the technical building blocks, the interpersonal ones, and the organizational ones.”
Transcript evidence from Adam Shostack — The Jenga View of Threat Modeling.
Said by Adam Shostack ·
“How many of these blocks can we remove and still get value from the work that we're doing is super important to organizations today.”
Transcript evidence from Adam Shostack — The Jenga View of Threat Modeling.
Said by Adam Shostack ·
“If I don't have the building block of I'm going to draw the system in some way, or even I'm going to draw the system with a data flow diagram, then what can happen is different people have different mental models of the system.”
Transcript evidence from Adam Shostack — The Jenga View of Threat Modeling.
Said by Adam Shostack ·
“Working the organization means going around and talking to people about what's going on, before a formal decision is made”
Transcript evidence from Adam Shostack — The Jenga View of Threat Modeling.
Said by Adam Shostack ·
“There's roles and responsibilities, right? Who does what? Okay, so I'm raising my hand here. I'm a software engineer working on the mobile app. What does it mean for me to do my job once we've made this change to the way we deliver things? What exactly am I supposed to deliver Who do I deliver it to? What does goodness look like? How do I get help?”
Transcript evidence from Adam Shostack — The Jenga View of Threat Modeling.
Said by Cindy Blake ·
“In fact, we've had DevOps groups that have gone off and purchased GitLab, including our— and used our security capabilities and said, okay, now we're going to unplug Fortify.”
Transcript evidence from Cindy Blake — Aligning security testing with Agile development.
Said by Cindy Blake ·
“On the feature branch, that's where you should be doing the scanning.”
Transcript evidence from Cindy Blake — Aligning security testing with Agile development.
Said by Cindy Blake ·
“But you don't often— the day-to-day pictures that you want to capture is part of your living experience and you want to share it with your friends and family, you don't use a camera for that anymore because it's not integrated.”
Transcript evidence from Cindy Blake — Aligning security testing with Agile development.
Said by Jannik Hollenbach ·
“We don't have like to have an administrator to spin up the instances by hand because it happens automatically in the background.”
Transcript evidence from Jannik Hollenbach — Multijuicer: JuiceShop with a side of Kubernetes.
Said by Jannik Hollenbach ·
“That's all you have to do and Helm will then install Multijuicer on the cluster.”
Transcript evidence from Jannik Hollenbach — Multijuicer: JuiceShop with a side of Kubernetes.
Said by Jannik Hollenbach ·
“, if you're a company who is using Multijuicer and I don't know about yet, we should start something like a, like a section in the README of companies who are already using it and can provide some feedback on how they're using it.”
Transcript evidence from Jannik Hollenbach — Multijuicer: JuiceShop with a side of Kubernetes.
Said by Speaker not identified ·
“You want to use the model to do an assessment of your software development practices, secure development practices in the organization.”
Transcript evidence from Sebastien Deleersnyder and Bart De Win — OWASP SAMM.
Said by Speaker not identified ·
“First of all, I think from a content perspective, I think it's, it's important that we are in line with modern development practices in an organization.”
Transcript evidence from Sebastien Deleersnyder and Bart De Win — OWASP SAMM.
Said by Speaker not identified ·
“We organize a lot of trainings and discussions with people, and they start seeing the value once they apply it to their company.”
Transcript evidence from Sebastien Deleersnyder and Bart De Win — OWASP SAMM.
Said by Speaker not identified ·
“A lot of folks take a gig looking what they're going to provide and not thinking about the longer-term strategy.”
Transcript evidence from Marc French, Steve Lipner, Maya Kaczorowski, DJ Schleen, Kim Wuyts — Season Six Wrap up.
Said by Speaker not identified ·
“If you think about what a CISO— the breadth of what a CISO needs to understand, you've got to start positioning yourself and put a plan together to say, all right, I'm in this space.”
Transcript evidence from Marc French, Steve Lipner, Maya Kaczorowski, DJ Schleen, Kim Wuyts — Season Six Wrap up.
Said by Speaker not identified ·
“I've talked to organizations trying to create SDLs, and if you have a classic security department or an IT-oriented security department.”
Transcript evidence from Marc French, Steve Lipner, Maya Kaczorowski, DJ Schleen, Kim Wuyts — Season Six Wrap up.
Said by Mark Merkow ·
“The moment you have an insecure line of code written or function, you should know that right away.”
Transcript evidence from Mark Merkow — Secure, Resilient, and Agile Software Development.
Said by Mark Merkow ·
“Getting these developers to not run tools but use the right tools in the right way makes a huge difference.”
Transcript evidence from Mark Merkow — Secure, Resilient, and Agile Software Development.
Said by Mark Merkow ·
“If we know how long average time it takes to remediate cross-site scripting, then we have a much better way of knowing what we can expect when we come across these kinds of vulnerabilities.”
Transcript evidence from Mark Merkow — Secure, Resilient, and Agile Software Development.
Said by Zsolt Imre ·
“Feeding an application with malformed data.”
Transcript evidence from Zsolt Imre — Fuzz testing is easy.
Said by Zsolt Imre ·
“The product security team tries to integrate it into the development pipeline.”
Transcript evidence from Zsolt Imre — Fuzz testing is easy.
Said by Zsolt Imre ·
“Read and analyze log files, try to detect anomalies based on the response messages, try to monitor for performance-related changes.”
Transcript evidence from Zsolt Imre — Fuzz testing is easy.
Said by Zsolt Imre ·
“I would recommend to start small and try to test something relatively simple and then keep improving.”
Transcript evidence from Zsolt Imre — Fuzz testing is easy.
Said by Zsolt Imre ·
“Start fuzz testing as simply as you would run unit tests locally on your laptop”
Transcript evidence from Zsolt Imre — Fuzz testing is easy.
Said by Chris Romeo ·
“I think the takeaway there for our listeners that might be trying to do this is, it will be wise of you to have a template/sample threat model like Adam had here as a place to start.”
Transcript evidence from Adam Shostack — Remote Threat Modeling.
Said by Adam Shostack ·
“I think the thing to think about as your listeners are asking, what tool do I want, is do I want a drawing tool like Miro that allows me to create these diagrams, get consensus around what we're working on, where the trust boundaries are, how it's put together, what the components are so that we can be”
Transcript evidence from Adam Shostack — Remote Threat Modeling.
Said by Robert Hurlbut ·
“But secondly, working remotely, of course, you need to make sure you have good remote tools in place, whether that be tools that, like we've been looking at here, that naturally allow good collaboration inside the tool, or you use other video screen sharing tools that allows multiple folks to see a screen or see”
Transcript evidence from Adam Shostack — Remote Threat Modeling.
Said by Kim Wuyts ·
“We have the data flow diagram for which you make a mapping table for each of the landing categories and then you systematically go over each of the cells of the table and look at the Linden knowledge, Linden threat trees, to determine whether for that specific DFD element, a privacy threat occurs.”
Transcript evidence from Kim Wuyts — Privacy Threat Modeling.
Said by Kim Wuyts ·
“Ideally, you don't share any data, but of course you will need to have some data in your systems and share it.”
Transcript evidence from Kim Wuyts — Privacy Threat Modeling.
Said by Kim Wuyts ·
“This is more about transparency, like as a data subject, as a user.”
Transcript evidence from Kim Wuyts — Privacy Threat Modeling.
Said by John Martin ·
“The logical extension of that is leading different organizations, leading different companies to build software smarter, better, and faster, including securing it better, including building software right the first time.”
Transcript evidence from John Martin — Preventing a Cyberpocalypse.
Said by Robert Hurlbut ·
“I think if I had to solve this problem and I only had 1 or 2 minutes to describe my explanation, which I'm sure we'd have weeks, if not months, to formulate this, but I'm almost thinking about the secure development lifecycle as your building code.”
Transcript evidence from John Martin — Preventing a Cyberpocalypse.
Said by John Martin ·
“We need to We need to stop endorsing the concepts of deferred responsibility.”
Transcript evidence from John Martin — Preventing a Cyberpocalypse.
Said by Jeremy Long ·
“Where I've been trying to get people to move is that we need to do continual patching of our libraries, make it part of the SDLC.”
Transcript evidence from Jeremy Long — It’s dependency check, not checker.
Said by Jeremy Long ·
“But, what Dependabot does is if a new version of a library comes out, you get a pull request, your CI kicks off, light is green, you can merge the pull request.”
Transcript evidence from Jeremy Long — It’s dependency check, not checker.
Said by Jeremy Long ·
“When you look at a real application, it has a hierarchy of transitive dependencies, which are dependencies of your dependencies.”
Transcript evidence from Jeremy Long — It’s dependency check, not checker.
Said by Jeremy Long ·
“He's built some tools to do, sandboxing of your build system, sandbox your, your Jenkins and monitor what files have changed, monitor what URLs people have been connecting out to.”
Transcript evidence from Jeremy Long — It’s dependency check, not checker.
Said by Jeremy Long ·
“But if you plan out your implementation correctly, when you're putting this into your pipeline, don't throw the data directory away or use an internal— we support internal, databases.”
Transcript evidence from Jeremy Long — It’s dependency check, not checker.
Said by Alyssa Miller ·
“If you build your threat model as part of documenting your user story before it goes into the backlog, now you don't have to worry about slowing down the development cycle anymore.”
Transcript evidence from Alyssa Miller — Experiences with DevOps + Automation and beyond.
Said by Alyssa Miller ·
“Initially, you can simplify it literally to a couple of simple questions about what critical data Is there any critical data being collected as a part of this? Is there critical functionality?”
Transcript evidence from Alyssa Miller — Experiences with DevOps + Automation and beyond.
Said by Alyssa Miller ·
“You have to continuously be trying to improve your processes, continuously deploying updates to that process that introduce those improvements so that not only is your end product getting better, but the way that you're developing it is getting better, which of course then feeds into the end product getting better.”
Transcript evidence from Alyssa Miller — Experiences with DevOps + Automation and beyond.
Said by Alyssa Miller ·
“You can build into that as well some of the threat modeling components that you need or the controls considerations.”
Transcript evidence from Alyssa Miller — Experiences with DevOps + Automation and beyond.
Said by Alyssa Miller ·
“It's got to be something carefully planned that you're looking at over— my recommendation honestly is planning it out over at least a 3-year period where you're taking it in bite-sized chunks.”
Transcript evidence from Alyssa Miller — Experiences with DevOps + Automation and beyond.
Said by Vandana Verma ·
“We have, when we When we talk about diversity, we have to consider other forms as well, like not men or women.”
Transcript evidence from Vandana Verma — Support each other.
Said by Vandana Verma ·
“While we are working towards including diverse team, we should understand that we as diverse group have an equal role to play.”
Transcript evidence from Vandana Verma — Support each other.
Said by Vandana Verma ·
“There are people who are sometimes scared of such talks, but we need to make the other party comfortable.”
Transcript evidence from Vandana Verma — Support each other.
Said by Vandana Verma ·
“But we have to consider that there will be some people whom we might need to train.”
Transcript evidence from Vandana Verma — Support each other.
Said by Vandana Verma ·
“Get those people as part of our cybersecurity teams.”
Transcript evidence from Vandana Verma — Support each other.
Said by DJ Schleen ·
“Tools is always the thing that you do last, right?”
Transcript evidence from DJ Schleen — DevOps: The Sec is Silent.
Said by DJ Schleen ·
“Automate the exception creation and the remediation plan and have this load lifted off of the developers and off the GRC, the other folks in the security organization.”
Transcript evidence from DJ Schleen — DevOps: The Sec is Silent.
Said by DJ Schleen ·
“Value stream map first, see what value you're trying to create, see how you develop software.”
Transcript evidence from DJ Schleen — DevOps: The Sec is Silent.
Said by Niels Tanis ·
“Always question like, what— how active are they fixing security issues”
Transcript evidence from Niels Tanis — 3rd Party Risk in a .NET World.
Said by Niels Tanis ·
“We always need to make sure that we're updating those libraries to latest versions.”
Transcript evidence from Niels Tanis — 3rd Party Risk in a .NET World.
Said by Niels Tanis ·
“You usually have a dependency graph”
Transcript evidence from Niels Tanis — 3rd Party Risk in a .NET World.
Said by Niels Tanis ·
“The best way would be to have microservices, let's say Docker containers, least privilege.”
Transcript evidence from Niels Tanis — 3rd Party Risk in a .NET World.
Said by Niels Tanis ·
“You should not rely on a single thing in order to do risk reduction.”
Transcript evidence from Niels Tanis — 3rd Party Risk in a .NET World.
Said by Maya Kaczorowski ·
“Instead of SSHing in and making a change, you patch You apply a patch to an existing application, you rebuild that as a new image, and you roll out that image.”
Transcript evidence from Maya Kaczorowski — Container and Orchestration Security.
Said by Maya Kaczorowski ·
“Knowing what ends up in your environment from a software point of view and where it came from.”
Transcript evidence from Maya Kaczorowski — Container and Orchestration Security.
Said by Maya Kaczorowski ·
“The first one I would mention would be structuring your environment.”
Transcript evidence from Maya Kaczorowski — Container and Orchestration Security.
Said by Maya Kaczorowski ·
“You've only deployed things to an environment that have been tested for vulnerabilities and come from your build pipeline, etc.”
Transcript evidence from Maya Kaczorowski — Container and Orchestration Security.
Said by Maya Kaczorowski ·
“Setting up role-based access control, setting up network policies, namespaces, etc., for them to work in your environment are some of the decisions you have to make on the first day.”
Transcript evidence from Maya Kaczorowski — Container and Orchestration Security.
Said by Geoff Hill ·
“If you think of it, the most basic form is that you want to have security introspection at each stage of the development and release journey, as it were.”
Transcript evidence from Geoff Hill — AppSec, DevSecOps, and Diplomacy.
Said by Geoff Hill ·
“But for the most part, it should happen automatically.”
Transcript evidence from Geoff Hill — AppSec, DevSecOps, and Diplomacy.
Said by Geoff Hill ·
“The security champion is going to help you during these activities because the security champion will bring forth, will be leading the charge there, and will have a knowledge of what the security backlog is and will have knowledge of what the current threat model looks like and introduce that to the team and will help the team to t-shirt size any issues that come along that have a whiff of security to them.”
Transcript evidence from Geoff Hill — AppSec, DevSecOps, and Diplomacy.
Said by Geoff Hill ·
“The security person should be up front and center and figuring out the security attributes of each one of those epics and/or business requirements and attaching them as part of the story or attachment as part of the epic, because then they will float down and they will make the life of the security champion a lot easier when they go through because they will see this metadata there and they will say, oh, well, the SME has already looked over this, and has figured this out that there's going to be a huge element of access control here.”
Transcript evidence from Geoff Hill — AppSec, DevSecOps, and Diplomacy.
Said by Geoff Hill ·
“Start off with one tool and then add other tools onto it.”
Transcript evidence from Geoff Hill — AppSec, DevSecOps, and Diplomacy.
Said by Erez Yalon ·
“A lot of users, a lot of developers, and even architects are not aware of the problems, and you cannot fix anything or remediate anything until you're aware of the situation.”
Transcript evidence from Erez Yalon — The OWASP API Security Project.
Said by Erez Yalon ·
“If you ask to get a document that you're not allowed to, you're not supposed to get it.”
Transcript evidence from Erez Yalon — The OWASP API Security Project.
Said by Erez Yalon ·
“Any resource that can be accessed should be limited.”
Transcript evidence from Erez Yalon — The OWASP API Security Project.
Said by Erez Yalon ·
“The action, the function is defined And the function should be only allowed according to a specific role and not to anyone.”
Transcript evidence from Erez Yalon — The OWASP API Security Project.
Said by Erez Yalon ·
“If you used to have a version 1 or version 2 of the API and now you move to version 3, please make sure that version 1 and 2 are either monitored or deprecated because if they are still exposed, it might be very risky, especially if you combine them and they are undocumented.”
Transcript evidence from Erez Yalon — The OWASP API Security Project.
Said by Steve Lipner ·
“SDL is driven by actual experience with what results in software that isn't secure.”
Transcript evidence from Steve Lipner — The Past, Present, and Future of SDL.
Said by Steve Lipner ·
“Start with the basics, make sure you have a security response process, and that you are capable of dealing with discovered vulnerabilities in the software you ship.”
Transcript evidence from Steve Lipner — The Past, Present, and Future of SDL.
Said by Steve Lipner ·
“Managing third-party components for security so that if there's a vulnerability discovered in some component you're using, about it and you're able to respond to it.”
Transcript evidence from Steve Lipner — The Past, Present, and Future of SDL.
Said by Steve Lipner ·
“Take the tools and take the steps that are part, that have to be done, and then overlay them so they're integrated into the way that the developers do development.”
Transcript evidence from Steve Lipner — The Past, Present, and Future of SDL.
Said by Steve Lipner ·
“You'd rather have desktop static analysis that reports the errors right then to the developers, and they can fix them as they go”
Transcript evidence from Steve Lipner — The Past, Present, and Future of SDL.
Said by David Kosorok ·
“Prevent means, and that's typically where it's least expensive to fix an issue.”
Transcript evidence from David Kosorok — The Three Pillars of an AppSec Program: Prevent, Detect, and React.
Said by David Kosorok ·
“You first of all have to create partnerships with the development teams in order to fully understand what's being required of them, what are the details they're being asked to do.”
Transcript evidence from David Kosorok — The Three Pillars of an AppSec Program: Prevent, Detect, and React.
Said by David Kosorok ·
“Using this benevolent society, that means that we're all working together to create something that is much better than we could have done individually.”
Transcript evidence from David Kosorok — The Three Pillars of an AppSec Program: Prevent, Detect, and React.
Said by Chris Romeo ·
“He had an interesting point about automation here in that he says, common in DevOps is a myth that everything, including all security, can be automated.”
Transcript evidence from Chris and Robert: A Taste of Hi-5.
Said by Chris Romeo ·
“When any interactions that we're able to have, we should all be looking for those opportunities to say, Hey, how can we help educate each other about things that we may not have as much perspective on?”
Transcript evidence from Chris and Robert: A Taste of Hi-5.
Said by Robert Hurlbut ·
“I think it, what you said, points to If you ran a bounty program before you even started all the other stuff that you need to start, and somebody found some extreme issues, what are you going to do then?”
Transcript evidence from Chris and Robert: A Taste of Hi-5.
Said by Bill Dougherty ·
“One of the things we started about 2 years ago is we realized it wasn't enough to do an annual risk assessment. or a vendor assessment.”
Transcript evidence from Bill Dougherty — INCLUDES NO DIRT, practical threat modeling for healthcare and beyond.
Said by Bill Dougherty ·
“That then, as you start digging into, yes, we need this, and yes, we have controls, you can then as a modeler say, I'm not sure those controls are sufficient.”
Transcript evidence from Bill Dougherty — INCLUDES NO DIRT, practical threat modeling for healthcare and beyond.
Said by Bill Dougherty ·
“I'd create a diagram that shows a user with a browser on their laptop and they're connecting to a web interface with a backend, and then there's an administrative interface for the, the legal person to go evaluate it, and there's trust boundaries, there's firewalls and things, and then I'd start looking at,”
Transcript evidence from Bill Dougherty — INCLUDES NO DIRT, practical threat modeling for healthcare and beyond.
Said by Marc French ·
“What ended up happening is we recognized we need to start embedding security inside the products.”
Transcript evidence from Marc French — The AppSec CISO.
Said by Marc French ·
“Be a business person, because you're going to get that appreciation.”
Transcript evidence from Marc French — The AppSec CISO.
Said by Marc French ·
“You've got to plan that out and make sure that you're taking roles that are going to fill in the boxes of all the different functions of security.”
Transcript evidence from Marc French — The AppSec CISO.
Said by Marc French ·
“You have got to set your chops in technology before you can be an AppSec person.”
Transcript evidence from Marc French — The AppSec CISO.
Said by Robert Hurlbut ·
“People have been telling me all sorts of wonderful little stories of like, now I have 2 mentors, or, this person introduced me to someone important and then I ended up getting a job because of it, or I'm reading all these books thanks to the people you introduced me to.”
Transcript evidence from Season 5 Finale — A cross section of #AppSec.
Said by Robert Hurlbut ·
“You can't start it by having some exec saying, now we're going to have secure software and writing a bunch of policies and handing them to everybody and saying, see, now we're secure.”
Transcript evidence from Season 5 Finale — A cross section of #AppSec.
Said by Chris Romeo ·
“Nobody should ever be voluntold because what does that mean?”
Transcript evidence from Season 5 Finale — A cross section of #AppSec.
Said by Ronnie Flathers ·
“Focus on getting that one technology stack secure”
Transcript evidence from Ronnie Flathers — Security programs big and small.
Said by Ronnie Flathers ·
“Identify key individuals within each team”
Transcript evidence from Ronnie Flathers — Security programs big and small.
Said by Ronnie Flathers ·
“Don't treat them separately, bake them into one”
Transcript evidence from Ronnie Flathers — Security programs big and small.
Said by Ronnie Flathers ·
“Make small improvements often”
Transcript evidence from Ronnie Flathers — Security programs big and small.
Said by Ronnie Flathers ·
“Get a handle on what you have, document where it is, what you have”
Transcript evidence from Ronnie Flathers — Security programs big and small.
Said by Brook Schoenfield ·
“You can't start it by having some exec saying, now we're going to have secure software, and writing a bunch of policies and handing them to everybody and saying, see, now we're secure.”
Transcript evidence from Brook Schoenfield — Security is a messy problem.
Said by Brook Schoenfield ·
“You're not going to get it in 6 months. You got to take a few years.”
Transcript evidence from Brook Schoenfield — Security is a messy problem.
Said by Brook Schoenfield ·
“If you reduce to start off, your baseline is your suite of high confidence checkers, and you hand those to developers— I've done this a bunch of times now and it works— hand those to developers and say, here, especially if you can get that on their desktop so while they're coding they can check, then you're using the tool in the way the developer wants to see, like a compiler.”
Transcript evidence from Brook Schoenfield — Security is a messy problem.
Said by Brook Schoenfield ·
“Now I'm going to run some unit tests around it, but I want to check it for security right then and there.”
Transcript evidence from Brook Schoenfield — Security is a messy problem.
Said by Brook Schoenfield ·
“If we hand back the responsibility and say, this is a shared responsibility.”
Transcript evidence from Brook Schoenfield — Security is a messy problem.
Said by Liran Tal ·
“We could have fixed those known vulnerabilities by updating the base image.”
Transcript evidence from Liran Tal — The state of open source software security.
Said by Liran Tal ·
“You're testing things as you probably should before you're deploying stuff”
Transcript evidence from Liran Tal — The state of open source software security.
Said by Liran Tal ·
“Security is part of the product quality that we're shipping.”
Transcript evidence from Liran Tal — The state of open source software security.
Said by Robert Hurlbut ·
“Caring about open source security is something that you would want to bake into your developer workflow, right?”
Transcript evidence from Liran Tal — Open Source Security — 5 Minute AppSec.
Said by Robert Hurlbut ·
“I think security is like you own a house, you live in an apartment, you do not want to leave the window open, the door open, or something unlocked.”
Transcript evidence from Liran Tal — Open Source Security — 5 Minute AppSec.
Said by Robert Hurlbut ·
“Because you are developing software, you do not want to be that person responsible for a data breach.”
Transcript evidence from Liran Tal — Open Source Security — 5 Minute AppSec.
Said by Steve Springett ·
“Use it as a risk prioritization tool, not as a way to not fix something”
Transcript evidence from Steve Springett — An insiders checklist for Software Composition Analysis.
Said by Robert Hurlbut ·
“Make sure they have support for the environments that your build process is relying upon.”
Transcript evidence from Steve Springett — An insiders checklist for Software Composition Analysis.
Said by Steve Springett ·
“You need to choose that vendor, that solution that you're going to partner with that knows supply chain and has a roadmap item to address all your capability concerns.”
Transcript evidence from Steve Springett — An insiders checklist for Software Composition Analysis.
Said by Steve Springett ·
“If you have tens of thousands of applications in your environment and you are producing software bill of materials in a CI/CD pipeline, DependencyTrack can automatically ingest, automatically analyze, and automatically alert you of any vulnerability or other types of risk.”
Transcript evidence from Steve Springett — OWASP Dependency Track — 5 Minute AppSec.
Said by Steve Springett ·
“You can, with DependencyTrack, identify those assets that are at risk in your environment.”
Transcript evidence from Steve Springett — OWASP Dependency Track — 5 Minute AppSec.
Said by Steve Springett ·
“At the end of the day, having all this intelligence is great, but you need to do something about it.”
Transcript evidence from Steve Springett — OWASP Dependency Track — 5 Minute AppSec.
Said by Elissa Shevinsky ·
“In some cases, they're almost certainly vulnerabilities, but in all cases, you need a developer to look at the error messages that are generated and determine if a fix is necessary.”
Transcript evidence from Elissa Shevinsky — Static Analysis early and often.
Said by Elissa Shevinsky ·
“Important to do proper security checks even though it's time-consuming.”
Transcript evidence from Elissa Shevinsky — Static Analysis early and often.
Said by Elissa Shevinsky ·
“Instead of waiting for one scan to run, then you do the next scan, then the next scan, run them all. at the same time.”
Transcript evidence from Elissa Shevinsky — Static Analysis early and often.
Said by Elissa Shevinsky ·
“One thing that I've been encouraging is for people who are junior developers to learn static analysis, because that's a space that I know, but there's probably a lot of other things like this as a way for them to level up, as a way for them to stand out and become better developers and, like, get interesting jobs.”
Transcript evidence from Elissa Shevinsky — Static Analysis early and often.
Said by Elissa Shevinsky ·
“I think the best practice is to do it.”
Transcript evidence from Elissa Shevinsky — Static Analysis early and often.
Said by Elissa Shevinsky ·
“I don't think we should ever be proud of not being nice, and we should welcome new people to the space.”
Transcript evidence from Elissa Shevinsky — Be Kind, Security People — 5 Minute AppSec.
Said by Elissa Shevinsky ·
“I don't think we should ever be proud of not being nice, and we should welcome new people to the space.”
Transcript evidence from Elissa Shevinsky — Be Kind, Security People — 5 Minute AppSec.
Said by Elissa Shevinsky ·
“But we need to remember it's all of us together, so be kind.”
Transcript evidence from Elissa Shevinsky — Be Kind, Security People — 5 Minute AppSec.
Said by Matt McGrath ·
“If they don't understand why they're doing it and the value that it adds, it's not going to stick”
Transcript evidence from Matt McGrath — Security coaches.
Said by Matt McGrath ·
“You have to have a passion for security.”
Transcript evidence from Matt McGrath — Security coaches.
Said by Matt McGrath ·
“Help those developers want to lead themselves to get better, to do their own research, to try next time instead of coming to us.”
Transcript evidence from Matt McGrath — Security coaches.
Said by Matt McGrath ·
“When you record those things and you track it, they can be leveraged in like a knowledge base.”
Transcript evidence from Matt McGrath — Security coaches.
Said by Matt McGrath ·
“Start small, grab a couple resources who are passionate, who want to help out”
Transcript evidence from Matt McGrath — Security coaches.
Said by Speaker not identified ·
“I happened to land in application security and discovered one of my superpowers is helping to tell the application security story.”
Transcript evidence from Erez Yalon and Liora Herman – The Application Security Village @ DefCon.
Said by Speaker not identified ·
“We truly believe it's something that we need everybody involved in whatever role that they are inside of a given company.”
Transcript evidence from Erez Yalon and Liora Herman – The Application Security Village @ DefCon.
Said by Speaker not identified ·
“In these computer things I described, I did software and security, but I did not know that I'm doing security.”
Transcript evidence from Erez Yalon and Liora Herman – The Application Security Village @ DefCon.
Said by Erez Yalon ·
“I said, hey, why there's no Upsec village?”
Transcript evidence from Erez Yalon – AppSec Village – 5 Minute AppSec.
Said by Erez Yalon ·
“I thought I should create an Upsec village.”
Transcript evidence from Erez Yalon – AppSec Village – 5 Minute AppSec.
Said by Erez Yalon ·
“I asked her if she would be willing to take this volunteer adventure with me”
Transcript evidence from Erez Yalon – AppSec Village – 5 Minute AppSec.
Said by Tommy Ross ·
“We do think that there is a need for the framework to be universal, to be adaptable to different technologies, different development processes, different coding languages.”
Transcript evidence from Tommy Ross — The BSA Framework for Secure Software.
Said by Tommy Ross ·
“Development of software should begin beyond the idea for the software, should begin with an assessment of the potential risks or the potential threats.”
Transcript evidence from Tommy Ross — The BSA Framework for Secure Software.
Said by Tommy Ross ·
“We began by looking through what we identified as commonly used or widely recognized literature, including best practice literature, NIST publications, internationally recognized standards, OWASP, of course, the Common Weakness Enumerators that we reference throughout the framework.”
Transcript evidence from Tommy Ross — The BSA Framework for Secure Software.
Said by Adam Shostack ·
“I'm thinking about threats that provoke people. I'm thinking about things that happen at that human layer and how we engineer to maximize the value and minimize the problems.”
Transcript evidence from Adam Shostack — Threat modeling layer 8 and conflict modeling.
Said by Adam Shostack ·
“When we engineer things, instead of waiting until the system has shipped to figure out what's going to go wrong, We anticipate it in some way and we start to plan for it.”
Transcript evidence from Adam Shostack — Threat modeling layer 8 and conflict modeling.
Said by Adam Shostack ·
“My goal is first to catalog, and then when we have catalogs of both the threats and the controls, we can start to build out threat modeling processes, methodologies that help you take this from here's a list of problems to here's the way to think about this as you're building what you're working on.”
Transcript evidence from Adam Shostack — Threat modeling layer 8 and conflict modeling.
Said by Adam Shostack ·
“The people building a photo upload and display filter feature need to think about how can that feature be abused in ways that will threaten the human users of the system or act as a threat to other users of the system.”
Transcript evidence from Adam Shostack — Threat modeling layer 8 and conflict modeling.
Said by Adam Shostack ·
“This requires collaboration. It requires people from diverse backgrounds, diverse perspectives, different skill sets coming together to figure this out.”
Transcript evidence from Adam Shostack — Threat modeling layer 8 and conflict modeling.
Said by Adam Shostack ·
“By asking, what are we working on? You can make sure that the things that you're working on are getting considered.”
Transcript evidence from Adam Shostack – Threat Modeling – 5 Minute AppSec.
Said by Adam Shostack ·
“By using a structured approach to asking what can go wrong, like STRIDE or attack trees or a kill chain, you can systematically go through each of the elements of your system to make sure that you've thought about security. And that can inform the entire remainder of your AppSec program and activities.”
Transcript evidence from Adam Shostack – Threat Modeling – 5 Minute AppSec.
Said by Adam Shostack ·
“If you don't threat model, you're shooting in the dark and hoping to hit the right things.”
Transcript evidence from Adam Shostack – Threat Modeling – 5 Minute AppSec.
Said by Zoe Braiterman ·
“Try to, get that insight into the threat model, but in terms of what the adversary might be doing”
Transcript evidence from Zoe Braiterman — AI, ML, AppSec, and a dose of data protection.
Said by Zoe Braiterman ·
“There's future for specific, type of AppSec training specifically for the data scientists.”
Transcript evidence from Zoe Braiterman — AI, ML, AppSec, and a dose of data protection.
Said by Zoe Braiterman ·
“Make sure that, at each, I guess, phase of the automated processes that, proper controls are taken at each of them”
Transcript evidence from Zoe Braiterman — AI, ML, AppSec, and a dose of data protection.
Said by Caroline Wong ·
“He said, you're going to apply to the top engineering schools in California and whichever one you get into, you're going to attend.”
Transcript evidence from Caroline Wong — Self-care and self-aware for security people.
Said by Caroline Wong ·
“One of the things that I've tried to learn how to do throughout my career is I've tried to learn how to prioritize and how to get on the same page as my manager with regards to my priorities and how to, understand the linkage between the organization's priorities, the security team's priorities, and”
Transcript evidence from Caroline Wong — Self-care and self-aware for security people.
Said by Caroline Wong ·
“I think that one thing that hiring managers can do, and this takes time, valuable time away from all the firefighting that you're doing while you're still trying to keep things running and get some of your projects done, is to think about what are the specific skills and tasks that I need this”
Transcript evidence from Caroline Wong — Self-care and self-aware for security people.
Said by Björn Kimminich ·
“No, we completely built it based on a library. So the only thing we are doing is storing the secrets in a bad way.”
Transcript evidence from Björn Kimminich — The new JuiceShop, GSOC, and Open Security Summit.
Said by Björn Kimminich ·
“Um, we— I decided to take out that challenge then because, uh, building your way around that and faking the vulnerability, that's nothing that we are so happy doing because then it gets unrealistic and very expensive to maintain at some point.”
Transcript evidence from Björn Kimminich — The new JuiceShop, GSOC, and Open Security Summit.
Said by Björn Kimminich ·
“You can switch the color theme, you can change the project or the application title, you can change all logos, you can completely rewrite the entire product list to fit whatever business you want to represent.”
Transcript evidence from Björn Kimminich — The new JuiceShop, GSOC, and Open Security Summit.
Said by Björn Kimminich ·
“But it's important to have some people on board who are able to review pull requests with the similar, uh, quality mindset that I have.”
Transcript evidence from Björn Kimminich — The new JuiceShop, GSOC, and Open Security Summit.
Said by Björn Kimminich ·
“The idea is to prepare your sessions properly and to make sure that your working sessions on-site then produce a good outcome.”
Transcript evidence from Björn Kimminich — The new JuiceShop, GSOC, and Open Security Summit.
Said by Björn Kimminich ·
“As a developer, you want the Juice Shop because I think you can learn almost every existing known security vulnerability in web applications from it, and not in a boring way, but by trying out attacks and practicing.”
Transcript evidence from Björn Kimminich — JuiceShop — 5 minute AppSec.
Said by Björn Kimminich ·
“That's, that's a little side project that allows you to quickly set up a CTF server in 5 minutes with the Juice Shop challenges with no manual data entry, a simple import feature.”
Transcript evidence from Björn Kimminich — JuiceShop — 5 minute AppSec.
Said by Björn Kimminich ·
“If you want to raise the awareness of your IT management, then you can use the Juice Shop More in a demonstration way.”
Transcript evidence from Björn Kimminich — JuiceShop — 5 minute AppSec.
Said by Speaker not identified ·
“Not only do we have to keep up with all the technology, we have to keep up with all the things about security to the new ways to protect things”
Transcript evidence from Nancy Gariché and Tanya Janca — DevSlop, the movement.
Said by Speaker not identified ·
“There are so many free security tools.”
Transcript evidence from Nancy Gariché and Tanya Janca — DevSlop, the movement.
Said by Speaker not identified ·
“Fix things And verify your security.”
Transcript evidence from Nancy Gariché and Tanya Janca — DevSlop, the movement.
Said by Tanya Janca ·
“Respond, use the hashtag and say if you're offering or asking or both and what topics.”
Transcript evidence from Tanya Janca — Mentoring Monday — 5 Minute AppSec.
Said by Tanya Janca ·
“I feel that if you have been doing your job for 2 years or more, that you likely know enough that you could mentor someone else.”
Transcript evidence from Tanya Janca — Mentoring Monday — 5 Minute AppSec.
Said by Tanya Janca ·
“I encourage people on Mondays or whenever, search the hashtag #MentoringMonday and respond to people, even if it's to suggest like, this is the best book I've ever read on this topic.”
Transcript evidence from Tanya Janca — Mentoring Monday — 5 Minute AppSec.
Said by Matt Clapham ·
“Think of the electronic medical records systems or the imaging archive systems, the IT, the operational IT that makes a healthcare delivery organization or a hospital more efficient in providing care.”
Transcript evidence from Matt Clapham — A perspective on appsec from the world of medical software.
Said by Chris Romeo ·
“Health information is such a different level that we need to secure because you can't get it back.”
Transcript evidence from Matt Clapham — A perspective on appsec from the world of medical software.
Said by Matt Clapham ·
“We need to make tech debt removal and renewal an even more common thing.”
Transcript evidence from Matt Clapham — A perspective on appsec from the world of medical software.
Said by Chris Romeo ·
“That we all have a lot to learn from each other.”
Transcript evidence from Jon McCoy — Hacker outreach.
Said by Robert Hurlbut ·
“I had heard all the stories about what you need to do in terms of bringing a burner phone, not turning on your phone, certainly not turning on Wi-Fi, Bluetooth, all those kinds of things.”
Transcript evidence from Jon McCoy — Hacker outreach.
Said by Robert Hurlbut ·
“I had heard all the stories about what you need to do in terms of bringing a burner phone, not turning on your phone, certainly not turning on Wi-Fi, Bluetooth, all those kinds of things.”
Transcript evidence from Jon McCoy — Hacker outreach.
Said by Omer Levi Hevroni ·
“You need to make sure that you pass the secret only to Kubernetes, and so only your application will have it but no one else.”
Transcript evidence from Omer Levi Hevroni — K8s can keep a secret?.
Said by Omer Levi Hevroni ·
“We need to talk about how you can consume these secrets in your code”
Transcript evidence from Omer Levi Hevroni — K8s can keep a secret?.
Said by Omer Levi Hevroni ·
“You need to tell the API what you want to encrypt.”
Transcript evidence from Omer Levi Hevroni — K8s can keep a secret?.
Said by Izar Tarandach ·
“You are describing the system by writing code.”
Transcript evidence from Izar Tarandach — Command line threat modeling with pytm.
Said by Izar Tarandach ·
“Keep the models small and confined to the pieces of the system that they describe.”
Transcript evidence from Izar Tarandach — Command line threat modeling with pytm.
Said by Izar Tarandach ·
“I would suggest to clone it from GitHub and start tweaking it and seeing See if you can come up with a data flow diagram that looks like your system.”
Transcript evidence from Izar Tarandach — Command line threat modeling with pytm.
Said by Simon Bennetts ·
“But I insisted they had a penetration test done on the software.”
Transcript evidence from Simon Bennetts — OWASP ZAP: past, present, and future.
Said by Simon Bennetts ·
“I thought even then it would be— wouldn't it be a good idea to have something which would automatically test my software for the most common security vulnerabilities?”
Transcript evidence from Simon Bennetts — OWASP ZAP: past, present, and future.
Said by Simon Bennetts ·
“It is not a replacement for a professional penetration test.”
Transcript evidence from Simon Bennetts — OWASP ZAP: past, present, and future.
Said by Bill Sempf ·
“Um, I talk about them and then I talk about what skills people need to have and then how to get those skills into your, uh, into your development group, um, and and start isolating folks that might be good candidates to be an AppSec person even though they don't know it themselves.”
Transcript evidence from Bill Sempf — Growing AppSec People and KidzMash.
Said by Bill Sempf ·
“I don't have all the answers yet, but it's unquestionable that So the main crux of the lessons that I learned from cultivating an individual in your group is what I've been doing, and I've done it successfully now at 5 different companies, a couple of them big, is you hold a training and instead of giving them”
Transcript evidence from Bill Sempf — Growing AppSec People and KidzMash.
Said by Bill Sempf ·
“10 to 15-year-olds and walked them through a couple of capture-the-flag-style challenges in web application security using an OWASP tool called Security Shepherd.”
Transcript evidence from Bill Sempf — Growing AppSec People and KidzMash.
Said by Georgia Weidman ·
“Mobility and IoT coming into the enterprise and us using cloud and bring your own device and all that.”
Transcript evidence from Georgia Weidman — Mobile, IoT, and Pen Testing.
Said by Georgia Weidman ·
“You can build, like, a super secure app, but if, like, the device that it's on is compromised, like ring-zero level, good luck.”
Transcript evidence from Georgia Weidman — Mobile, IoT, and Pen Testing.
Said by Georgia Weidman ·
“Mobile app security, but what's being missed, I think, and perhaps is making a resurgence with things like mobile threat defense, is that, it's a whole device.”
Transcript evidence from Georgia Weidman — Mobile, IoT, and Pen Testing.
Said by Robert Hurlbut ·
“We can get into it at some point in the discussion about what some of the differences between security practices like red teaming, purple teaming, and chaos engineering, and there are major differences.”
Transcript evidence from Conclusion: Season 4 Finale.
Said by Chris Romeo ·
“What we have is a central repository a set of JavaScript libraries that we're monitoring, where we have a list of vulnerabilities connected to them, and we have some ways of identifying each library and each version.”
Transcript evidence from Conclusion: Season 4 Finale.
Said by Robert Hurlbut ·
“The philosophy around the project overall is help as many people as possible with a single list, with very concise, very clear description of what to avoid.”
Transcript evidence from Conclusion: Season 4 Finale.
Said by Geoff Hill ·
“Then if you start building out too many attack trees, then about a month later you find out that things have changed and you have to build a whole new set of attack trees.”
Transcript evidence from Geoff Hill -- Rapid Threat Model Prototyping Process.
Said by Geoff Hill ·
“They've spent like a day doing model storming and in sprint zero and they're off to the races and you're already behind the times because you're already telling them, well, guys, you have to put in the mitigation that we described here.”
Transcript evidence from Geoff Hill -- Rapid Threat Model Prototyping Process.
Said by Geoff Hill ·
“In order to make your system resilient, you have to take into account that every inbound from other systems, whether they're inside the company or not, are potentially inbound attack vectors, and therefore they're outside of your control.”
Transcript evidence from Geoff Hill -- Rapid Threat Model Prototyping Process.
Said by Bill Wilder ·
“Some of the things that the cloud helps you do better than you might've had traditional access to is access to a more complete toolset So the uh, I can— I know Azure best, but this would apply to most clouds.”
Transcript evidence from Bill Wilder -- Running Azure Securely.
Said by Bill Wilder ·
“Like in the on-prem world, if you have a machine in the cloud, you may want to remotely access it for management and diagnostic reasons, normal stuff.”
Transcript evidence from Bill Wilder -- Running Azure Securely.
Said by Bill Wilder ·
“I mentioned before that you need to authenticate to Azure Key Vault in order to access, secrets within it or to use the secrets within it that are— that it won't give you to, like, exercise the use of private key to sign something or to decrypt a value.”
Transcript evidence from Bill Wilder -- Running Azure Securely.
Said by Robert Hurlbut ·
“It's, when you have developers or architects or anybody who is involved in software development start to think about that and start to integrate it in, we always talk about trying to get security in early.”
Transcript evidence from Matt Konda -- OWASP Glue.
Said by Matt Konda ·
“Glue originated when we were working with companies that wanted to do— originally they wanted to do static analysis, on languages that didn't have good coverage in commercial tools, and they wanted them to integrate into their developer's toolset.”
Transcript evidence from Matt Konda -- OWASP Glue.
Said by Matt Konda ·
“It's wrapping those almost live tools and giving you expected results, which is very powerful because it reduces false positives, right?”
Transcript evidence from Matt Konda -- OWASP Glue.
Said by Speaker not identified ·
“But I think one of the One of the main points that I see is that most companies, their primary control at the moment is the application security testing, as in application penetration testing, getting someone to come in and test their applications.”
Transcript evidence from Josh Grossman, Avi Douglen, and Ofer Maor -- AppSec in Israel and Three Talks to watch from AppSec USA.
Said by Speaker not identified ·
“Threat modeling gives a huge amount of value.”
Transcript evidence from Josh Grossman, Avi Douglen, and Ofer Maor -- AppSec in Israel and Three Talks to watch from AppSec USA.
Said by Speaker not identified ·
“What I've had my talk about today is how do we build a way to do test automation, security test automation, as part of this workflow of continuous delivery where we get organizations pushing hundreds of updates every day into production?”
Transcript evidence from Josh Grossman, Avi Douglen, and Ofer Maor -- AppSec in Israel and Three Talks to watch from AppSec USA.
Said by Daniel Miessler ·
“It's 10 things that you should avoid doing.”
Transcript evidence from Daniel Miessler -- OWASP IoT Top 10.
Said by Daniel Miessler ·
“But I do feel like manufacturers need a different project because I'm looking to launch a number of projects around this, but they will be independent rather than making this one larger.”
Transcript evidence from Daniel Miessler -- OWASP IoT Top 10.
Said by Daniel Miessler ·
“It's in the OWASP IoT security channel, so people show up, they give feedback, but there was a core of about 10 people and we would go through all that data and we would then use our judgment, right?”
Transcript evidence from Daniel Miessler -- OWASP IoT Top 10.
Said by Travis McPeak ·
“If you haven't used a certain permission in a given time, it will remove that permission”
Transcript evidence from Travis McPeak -- SecOps Makes Developers Lives Easier.
Said by Travis McPeak ·
“Anytime we see friction points like that, we see automation opportunities.”
Transcript evidence from Travis McPeak -- SecOps Makes Developers Lives Easier.
Said by Travis McPeak ·
“Security Monkey will continuously monitor all of our accounts for all these assets and then track the version that you currently have”
Transcript evidence from Travis McPeak -- SecOps Makes Developers Lives Easier.
Said by Travis McPeak ·
“Once you have the state of your inventory Then you can look for misconfigurations and alert those, and in some cases even fix them automatically.”
Transcript evidence from Travis McPeak -- SecOps Makes Developers Lives Easier.
Said by Travis McPeak ·
“We would prefer not to build something ourselves if there's something that exists already that we can use.”
Transcript evidence from Travis McPeak -- SecOps Makes Developers Lives Easier.
Said by Chris Romeo ·
“The first one, I want everyone to have a shared responsibility of security.”
Transcript evidence from Chris Romeo -- Security Culture Hacking: Disrupting the Security Status Quo.
Said by Chris Romeo ·
“As security people, we gotta be more open. We can't be so afraid to share our information and share our experiences with the people that we're working with.”
Transcript evidence from Chris Romeo -- Security Culture Hacking: Disrupting the Security Status Quo.
Said by Chris Romeo ·
“You have to, this assessment has to become a strategy, and so I'm gonna share with you 15 different hacks that I've experienced in different companies.”
Transcript evidence from Chris Romeo -- Security Culture Hacking: Disrupting the Security Status Quo.
Said by Chris Romeo ·
“The first hack that I have in this is learn the methodology and lingo of the groups that you're going to try to influence.”
Transcript evidence from Chris Romeo -- Security Culture Hacking: Disrupting the Security Status Quo.
Said by Chris Romeo ·
“Hack number 2 is learn how to listen and collaborate with the people you're trying to influence here.”
Transcript evidence from Chris Romeo -- Security Culture Hacking: Disrupting the Security Status Quo.
Said by Jim Manico ·
“It requires programmers to primarily do parameterized queries, different kind— is the main defense.”
Transcript evidence from Jim Manico -- The Extremely Unabridged History of SQLi and XSS.
Said by Jim Manico ·
“Have different kinds of input validation, different kinds of data sanitization and detection and logging of these attacks coming in.”
Transcript evidence from Jim Manico -- The Extremely Unabridged History of SQLi and XSS.
Said by Jim Manico ·
“The question is, how can we build frameworks that developers use day in and day out that don't have these problems?”
Transcript evidence from Jim Manico -- The Extremely Unabridged History of SQLi and XSS.
Said by Jeff Williams ·
“We should be protecting our applications against the threats that are 5 or 10 years out because our applications that we're building today are probably going to still be in service in 5 to 10 years.”
Transcript evidence from Jeff Williams -- The History of OWASP.
Said by Chris Romeo ·
“Let's not make things complicated because complicated means things don't happen.”
Transcript evidence from Jeff Williams -- The History of OWASP.
Said by Jeff Williams ·
“I bet you don't know very much about who wrote that code, how they tested it, what tools they used, were the developers trained, what open source components are they using, what other AppSec processes do they use to make sure that thing is secure?”
Transcript evidence from Jeff Williams -- The History of OWASP.
Said by Björn Kimminich ·
“If they choose to register with their Google account, there's a little bit more technical way to be that, but that's something that managers can understand if you show them because the Juice Shop behaves silly after doing a proper OAuth 2 authentication with Google.”
Transcript evidence from Bjorn Kimminich -- The Joy of the Vulnerable Web: JuiceShop.
Said by Björn Kimminich ·
“But what we did, which is the real benefit coming from our side, we created a little side project which is a command line tool which you run and then you answer a couple of questions like, hey, what CTF framework do you want to use?”
Transcript evidence from Bjorn Kimminich -- The Joy of the Vulnerable Web: JuiceShop.
Said by Björn Kimminich ·
“I'm not— because I think if the developers should learn how the vulnerabilities work, they should concentrate on that and use tools they know and not try to learn tools at the same time.”
Transcript evidence from Bjorn Kimminich -- The Joy of the Vulnerable Web: JuiceShop.
Said by Swaroop Yermalkar ·
“Developers should keep in mind that the app is going to be accessed on the rooted device or the compromised device”
Transcript evidence from Swaroop Yermalkar -- iGoat and iOS Mobile Pen Testing.
Said by Swaroop Yermalkar ·
“The user will have access to everything, like whatever they are storing in the keychain or whatever is in the local storage”
Transcript evidence from Swaroop Yermalkar -- iGoat and iOS Mobile Pen Testing.
Said by Swaroop Yermalkar ·
“You need to start the server either as a Docker or it's already there in the AWS.”
Transcript evidence from Swaroop Yermalkar -- iGoat and iOS Mobile Pen Testing.
Said by Speaker not identified ·
“We have some organizations that are dipping their toes into working with the external hacking community And they'll start their program in what's called private mode.”
Transcript evidence from Adam Bacchus and Jon Bottarini -- Two Sides to a Bug Bounty: The Researcher and The Program.
Said by Speaker not identified ·
“In additional to— or excuse me, in addition to the tactical benefit of finding and squashing those individual bugs, you can perform some root cause analysis of the bugs flowing through your program and identify and implement systematic improvements to your overall security posture.”
Transcript evidence from Adam Bacchus and Jon Bottarini -- Two Sides to a Bug Bounty: The Researcher and The Program.
Said by Speaker not identified ·
“If you want to learn how to perform a cross-site scripting attack, Going through the training modules on that site will give you all the information that you need to know, and then you can take that information and apply it to the different types of bug bounties on the platform.”
Transcript evidence from Adam Bacchus and Jon Bottarini -- Two Sides to a Bug Bounty: The Researcher and The Program.
Said by Erlend Oftedal ·
“Build our— learn stuff about security to help us become better developers and help our projects”
Transcript evidence from Erlend Oftedal -- What You Require, You Must Also Retire.
Said by Erlend Oftedal ·
“Working on developing secure solutions or the security controls for solutions.”
Transcript evidence from Erlend Oftedal -- What You Require, You Must Also Retire.
Said by Erlend Oftedal ·
“One of the other projects would ask me to come and I would come and review their code or do some security testing on their code.”
Transcript evidence from Erlend Oftedal -- What You Require, You Must Also Retire.
Said by Chris Romeo ·
“On the DevOps side, I do believe that if you provide a way to capture this information in an easy, more code-like way with YAML, especially YAML being a very popular way of doing things with most DevOps implementations, I felt that it would become a lot more user-friendly for an engineering team or a DevOps team to”
Transcript evidence from Abhay Bhargav -- Threat Modeling as Code.
Said by Chris Romeo ·
“The focus of the workshop is to create automated pipelines.”
Transcript evidence from Abhay Bhargav -- Threat Modeling as Code.
Said by Chris Romeo ·
“The tools we'll be using in this workshop are going to be OWASP ZAP, which is my number one favorite for testing applications, and it's probably got the best API in the business.”
Transcript evidence from Abhay Bhargav -- Threat Modeling as Code.
Said by Chris Romeo ·
“The first step is begin with a manageable threat library.”
Transcript evidence from Tony UV -- Threat Libraries in the Cloud.
Said by Chris Romeo ·
“Think about the things that are going to be detrimental to your application, to your business, and write those down.”
Transcript evidence from Tony UV -- Threat Libraries in the Cloud.
Said by Chris Romeo ·
“Step 2 is now it's time to substantiate stuff.”
Transcript evidence from Tony UV -- Threat Libraries in the Cloud.
Said by Aaron Rinehart ·
“Uh, so I'll lead it with, uh, if you go to principlesofchaos.org, it's the marquee seminal, uh, doctrine when it comes to chaos engineering that everyone sticks to.”
Transcript evidence from Aaron Rinehart -- Chaos Engineering and #AppSec.
Said by Aaron Rinehart ·
“What Chaos Monkey does is during business hours, that's a key part, during business hours, it will, it will randomly bring down a VM on one of Netflix's production systems.”
Transcript evidence from Aaron Rinehart -- Chaos Engineering and #AppSec.
Said by Aaron Rinehart ·
“That's what the focus is of chaos engineering, is to sit down with your product team, your app team, and say, okay, hey, we think we're seeing these failures happening.”
Transcript evidence from Aaron Rinehart -- Chaos Engineering and #AppSec.
Said by Speaker not identified ·
“It's about helping to make sure we have the right mentorship programs.”
Transcript evidence from Jessica Robinson and Vandana Verma-- WIA: Women in #AppSec.
Said by Speaker not identified ·
“The next thing that I would say is that as much as possible, start— get— because we do have monthly meetings, there should be a representative from your chapter on these monthly calls.”
Transcript evidence from Jessica Robinson and Vandana Verma-- WIA: Women in #AppSec.
Said by Speaker not identified ·
“The other thing is because men many times at conferences are leading these conferences, they're the presidents of the chapter, there's more men on boards even here at OWASP, that when we have conferences like this and we're thinking, okay, we want to have speakers, how can we make sure that we have women speakers?”
Transcript evidence from Jessica Robinson and Vandana Verma-- WIA: Women in #AppSec.
Said by Karen Staley ·
“We said, you could travel anywhere in the world and get online and find somebody from OWASP.”
Transcript evidence from Karen Staley -- A Conversation with Karen.
Said by Robert Hurlbut ·
“If you're, if you're involved and you're someone who uses OWASP and attends chapter meetings and does those type of things and you're not a member, you should consider because 40% of the membership goes to the local chapter.”
Transcript evidence from Karen Staley -- A Conversation with Karen.
Said by Karen Staley ·
“We can only do that through the community, the support of the community, being engaged with the community, and being a part of the community.”
Transcript evidence from Karen Staley -- A Conversation with Karen.
Said by Mohammed Imran ·
“The other tool you have to learn is how a CI/CD system works.”
Transcript evidence from Mohammed Imran -- Back to the Lab Again with a DevOps.
Said by Mohammed Imran ·
“No matter which stack you're using or, cloud provider you're using, the basics and fundamentals are same.”
Transcript evidence from Mohammed Imran -- Back to the Lab Again with a DevOps.
Said by Mohammed Imran ·
“There you have a wiki which explains you how all of this is set up and then how you can embed security as part of that.”
Transcript evidence from Mohammed Imran -- Back to the Lab Again with a DevOps.
Said by Niels Tanis ·
“Any third-party library that will be referenced by the main project will be exposed if there is something inside which is called controller.”
Transcript evidence from Niels Tanis -- A Slice of the Razor with ASP.Net Core.
Said by Niels Tanis ·
“Make sure that the data is properly sanitized and validated before you do anything with it”
Transcript evidence from Niels Tanis -- A Slice of the Razor with ASP.Net Core.
Said by Niels Tanis ·
“Don't use your data model exposed directly unless it's some closed system administration of that data structure.”
Transcript evidence from Niels Tanis -- A Slice of the Razor with ASP.Net Core.
Said by Ofer Maor ·
“We need to get as much as we can early on in the IDE, but we need to do things that can happen later in the build as you integrate all the pieces together.”
Transcript evidence from Ofer Maor -- A Pen Testers Transition to #AppSec: #VoteForOfer.
Said by Ofer Maor ·
“Part of the challenge we have to go through is getting results that are far more actionable.”
Transcript evidence from Ofer Maor -- A Pen Testers Transition to #AppSec: #VoteForOfer.
Said by Ofer Maor ·
“Security needs to come in layers.”
Transcript evidence from Ofer Maor -- A Pen Testers Transition to #AppSec: #VoteForOfer.
Said by Matt Tesauro ·
“Now it allowed me to have sane conversations about resource allocation on my team because, everyone's agile and things are switching around quickly and you have to shift work, but I didn't understand the cost of that shifting until I had it managed with something like DefectDojo.”
Transcript evidence from Matt Tesauro -- #AppSec Pipeline as Toolbox.
Said by Matt Tesauro ·
“It's— fundamentally, it's a way to — well, the best use of it in my mind is to have an automated way to do baseline testing across the suite of applications that your program has.”
Transcript evidence from Matt Tesauro -- #AppSec Pipeline as Toolbox.
Said by Matt Tesauro ·
“Then the final phase is what we call delivery, and that's putting stuff into a vulnerability repository like DefectDojo and then pushing out metrics and reports and bugs into bug trackers.”
Transcript evidence from Matt Tesauro -- #AppSec Pipeline as Toolbox.
Said by Stephen de Vries ·
“It would automatically tell you these are the set of requirements you need to build into your application.”
Transcript evidence from Stephen de Vries -- Threat Modeling with a bit of #Startup.
Said by Stephen de Vries ·
“We need to give developers more advice than that.”
Transcript evidence from Stephen de Vries -- Threat Modeling with a bit of #Startup.
Said by Stephen de Vries ·
“Don't try and force them into using security tools.”
Transcript evidence from Stephen de Vries -- Threat Modeling with a bit of #Startup.
Said by Julien Vehent ·
“If you have X number of security engineers in your team, make sure they are embedded with product teams, that they are part of these engineering discussions very early on so that they can advocate for specific security controls.”
Transcript evidence from Julien Vehent -- Securing DevOps.
Said by Julien Vehent ·
“They are very tactical items, very short documents that we put in GitHub issues as markdown with checkboxes and whatnot, and developers and operators can go through them very quickly and make sure they're compliant with our security principles.”
Transcript evidence from Julien Vehent -- Securing DevOps.
Said by Julien Vehent ·
“To me, the real value of security in DevOps is automating everything that can be automated, the low-hanging fruits, so you can free up time to go manually test or implement the complex stuff.”
Transcript evidence from Julien Vehent -- Securing DevOps.
Said by Julien Vehent ·
“You make it repeatable. You take those tests, you script them, you automate them. Some of it is not scriptable at all, but a lot of it is, so that even if your engineers rotate, you have a turnover, then your tests continue to run the same way.”
Transcript evidence from Julien Vehent -- Securing DevOps.
Said by Julien Vehent ·
“What you want to do is add a new test. every time you do a loop over this cycle and make sure that everything goes green so you can flag it for regression if it ever goes back to red.”
Transcript evidence from Julien Vehent -- Securing DevOps.
Said by Christian Folini ·
“Then you can tune and reconfigure it to bring the 80-90% to far beyond 95%, up to 99%.”
Transcript evidence from Christian Folini -- CRS and an Abstraction Layer.
Said by Christian Folini ·
“We need to get closer to the developers and the toolset is all there, the toolchain is there, it's open source, you can very easily integrate it into your process in your company, how you do how you do software.”
Transcript evidence from Christian Folini -- CRS and an Abstraction Layer.
Said by Christian Folini ·
“Integrate it wherever you want to, where you validate input.”
Transcript evidence from Christian Folini -- CRS and an Abstraction Layer.
Said by Sean Wright ·
“But many people lose sight of the fact that HTTPS is there for integrity.”
Transcript evidence from Sean Wright -- Google Chrome and the Case of the Disappearing HTTP.
Said by Sean Wright ·
“Think small businesses who do not, who do not have the technical expertise I can see that argument, but at the same time, there's a lot been done over the years to make HTTPS simple.”
Transcript evidence from Sean Wright -- Google Chrome and the Case of the Disappearing HTTP.
Said by Chris Romeo ·
“When I think of usable security, usable security should be built in and it should be— you should have to make an active decision to disable it, and it should ultimately make the world a better place.”
Transcript evidence from Sean Wright -- Google Chrome and the Case of the Disappearing HTTP.
Said by Chris Romeo ·
“When we build requirements, we have to, we have to have security in the conversation so we're building good security requirements so that we can build good design, so that now we can take the design and implement it correctly in software and then code.”
Transcript evidence from Conclusion: All the Pieces You Need for an #AppSec Program.
Said by Chris Romeo ·
“That should be able to be run from my IDE, prior to check-in so I know I'm going to pass.”
Transcript evidence from Conclusion: All the Pieces You Need for an #AppSec Program.
Said by Chris Romeo ·
“If you're not constantly updating your code to use new and newer versions of those components as a best practice, it's very hard for organizations to respond when they absolutely have to do a 24-hour turnaround to mitigate something.”
Transcript evidence from Conclusion: All the Pieces You Need for an #AppSec Program.
Said by Martin Knobloch ·
“OWASP was founded from developers for developers, how to write secure software, how to build secure applications.”
Transcript evidence from Martin Knobloch -- OWASP, Reach Out; We Are Known and Misunderstood.
Said by Martin Knobloch ·
“The testing guide is how to validate the security.”
Transcript evidence from Martin Knobloch -- OWASP, Reach Out; We Are Known and Misunderstood.
Said by Martin Knobloch ·
“When you tell them what is there, how you can use it, how you can use it in your environment, be it DevOps, DevSecOps, continuous delivery, continuous integration”
Transcript evidence from Martin Knobloch -- OWASP, Reach Out; We Are Known and Misunderstood.
Said by Devin McMasters ·
“The main thing is that some incident response, security response program, the core pieces of it need to be in place.”
Transcript evidence from Devin McMasters -- Bug Bounty with a Side of Empathy.
Said by Devin McMasters ·
“If you go into it with a wide-open scope or not well-defined what you want them to attack or look for, you're in for a nightmare.”
Transcript evidence from Devin McMasters -- Bug Bounty with a Side of Empathy.
Said by Devin McMasters ·
“Go have a strong sense of empathy towards the other people you're working with, the security researchers and hackers, and try to understand your business engagement with them from their point of view.”
Transcript evidence from Devin McMasters -- Bug Bounty with a Side of Empathy.
Said by Apollo Clark ·
“The user stories work well because you can give these to business executives and say, here's what we're shooting for.”
Transcript evidence from Apollo Clark -- Malicious User Stories.
Said by Apollo Clark ·
“How does that translate into specific business practices?”
Transcript evidence from Apollo Clark -- Malicious User Stories.
Said by Apollo Clark ·
“It allows business owners who don't know how to write code to write these user stories and use cases and then hand that off to the security team and say, okay, here's what we want to test for.”
Transcript evidence from Apollo Clark -- Malicious User Stories.
Said by Megan Roddie ·
“Focusing on their benefits and not focusing on their disabilities.”
Transcript evidence from Megan Roddie -- Neurodiversity in Security.
Said by Megan Roddie ·
“The information security industry needs to do a better job at writing job postings.”
Transcript evidence from Megan Roddie -- Neurodiversity in Security.
Said by Megan Roddie ·
“If you put them in front of a keyboard, they could prove themselves.”
Transcript evidence from Megan Roddie -- Neurodiversity in Security.
Said by Megan Roddie ·
“I encourage a lot of bidirectional communication.”
Transcript evidence from Megan Roddie -- Neurodiversity in Security.
Said by Chase Schultz ·
“That's why I'm almost thinking out loud here, but is there a secure— is there a need for secure coding in the world of hardware?”
Transcript evidence from Chase Schultz -- AppSec and Hardware.
Said by Chris Romeo ·
“Anyway, a potential attacker that would be set up in a man-in-the-middle position during a firmware update would be able to unpack that firmware, make modifications, add their own password hash, or turn on SSH, etc., and then, repackage that firmware and then make sure that it got down to you.”
Transcript evidence from Chase Schultz -- AppSec and Hardware.
Said by Chris Romeo ·
“It being able to access the kernel space and, being able to read out the entire— the entirety of the kernel space where, you might have very sensitive cryptographic operations like you said, that thing.”
Transcript evidence from Chase Schultz -- AppSec and Hardware.
Said by Chris Romeo ·
“That's a hard, fundamentally hard problem to solve when you don't live in the application and you don't have access to the dataset.”
Transcript evidence from John Melton -- #OWASP AppSensor.
Said by Chris Romeo ·
“Then I think setting up AppSensor, do it as a proof of concept and then add one exception and see what data you generate.”
Transcript evidence from John Melton -- #OWASP AppSensor.
Said by Chris Romeo ·
“Then I think setting up AppSensor, do it as a proof of concept and then add one exception and see what data you generate.”
Transcript evidence from John Melton -- #OWASP AppSensor.
Said by David Habusha ·
“You have to run continuous scans of code within, starting from your development time to the build time to the deployment time.”
Transcript evidence from David Habusha -- Third Party Software is not a Cathedral, It’s a Bazaar.
Said by David Habusha ·
“You need to constantly map these dependencies and stay on top of what you have in your systems.”
Transcript evidence from David Habusha -- Third Party Software is not a Cathedral, It’s a Bazaar.
Said by David Habusha ·
“People should start looking at using safe components, using the latest version of these components, using components that have a low number of vulnerabilities.”
Transcript evidence from David Habusha -- Third Party Software is not a Cathedral, It’s a Bazaar.
Said by David Habusha ·
“Then you need to make sure that this taps into your CI/CD process.”
Transcript evidence from David Habusha -- Third Party Software is not a Cathedral, It’s a Bazaar.
Said by David Habusha ·
“But you need to constantly monitor the security advisories.”
Transcript evidence from David Habusha -- Third Party Software is not a Cathedral, It’s a Bazaar.
Said by Steve Springett ·
“Once you build on top of existing components, those vulnerabilities, those properties of those components become an inherent property of the overall application.”
Transcript evidence from Steve Springett -- Dependency Check and Dependency Track.
Said by Steve Springett ·
“If you're not constantly updating your code to use new and newer versions of those components as a best practice, it's very hard for organizations to respond when they absolutely have to do a 24-hour turnaround to mitigate something.”
Transcript evidence from Steve Springett -- Dependency Check and Dependency Track.
Said by Chris Romeo ·
“If you do try to do a forklift-style upgrade where you're taking an old version of software that is vulnerable and replacing it with a more modern version, it's going to break all the API connections and other things that were happening there.”
Transcript evidence from Steve Springett -- Dependency Check and Dependency Track.
Said by Steven Wierckx ·
“The first thing you need to do is create some a model.”
Transcript evidence from Steven Wierckx -- The #OWASP Threat Modeling Project.
Said by Steven Wierckx ·
“If you were to create some very good threat models on that, then an organization that is new to threat modeling could take the reference threat model, see how their applications differ from that one, and then you need to do the threat modeling on the small differences.”
Transcript evidence from Steven Wierckx -- The #OWASP Threat Modeling Project.
Said by Steven Wierckx ·
“But if you can use an open source tool that's for free, then I think that for a beginner, that's a nice place to start.”
Transcript evidence from Steven Wierckx -- The #OWASP Threat Modeling Project.
Said by Jim Manico ·
“It's a collection of single-topic guides on primarily secure coding, but AppSec in general.”
Transcript evidence from Jim Manico -- The #OWASP Cheat Sheet Project.
Said by Robert Hurlbut ·
“With all the cheat sheets and all the different topics, and of course over the years, I imagine some of them you have to keep them up to date, right?”
Transcript evidence from Jim Manico -- The #OWASP Cheat Sheet Project.
Said by Jim Manico ·
“That's where you should focus your attention.”
Transcript evidence from Jim Manico -- The #OWASP Cheat Sheet Project.
Said by Neil Smithline ·
“You go through, you create the logging of that information, and then you have to take those logs.”
Transcript evidence from Neil Smithline -- OWASP Top 10 #10: Logging.
Said by Chris Romeo ·
“To start, we have to ensure we're properly generating the right logs so that we have something to even perform monitoring on.”
Transcript evidence from Neil Smithline -- OWASP Top 10 #10: Logging.
Said by Neil Smithline ·
“Try to mask those as best as possible in the log, certainly.”
Transcript evidence from Neil Smithline -- OWASP Top 10 #10: Logging.
Said by Jim Routh ·
“Instead, focus on a software security program to improve productivity for the money that we spend on software.”
Transcript evidence from Jim Routh -- Selling #AppSec Up The Chain.
Said by Jim Routh ·
“If we can eliminate the defect and then fix the defects earlier in the lifecycle, those are the 2 economic levers that drive productivity.”
Transcript evidence from Jim Routh -- Selling #AppSec Up The Chain.
Said by Jim Routh ·
“The reason I don't do that is the software security program has to be embedded into software development, and the developers have to own it.”
Transcript evidence from Jim Routh -- Selling #AppSec Up The Chain.
Said by Robert Hurlbut ·
“Anything that's related to the Martin Fowler series is good to get a good foundation on architecture in general.”
Transcript evidence from Chris and Robert -- #AppSec Recommendations.
Said by Robert Hurlbut ·
“YouTube has a lot of security content, some from the Iron Geek site, but even beyond that, some of the conferences do their own recordings.”
Transcript evidence from Chris and Robert -- #AppSec Recommendations.
Said by Chris Romeo ·
“If you're a security professional and/or you're a developer who's new to security and you somehow at this stage don't have a good grasp of DevOps, this is a real nice book to take you through what is DevOps.”
Transcript evidence from Chris and Robert -- #AppSec Recommendations.
Said by Chris Romeo ·
“Go to the social events, hang out, walk up to somebody.”
Transcript evidence from Chris and Robert -- #AppSec Recommendations.
Said by Robert Hurlbut ·
“You set up alerts on keywords.”
Transcript evidence from Chris and Robert -- #AppSec Recommendations.
Said by Magen Wu ·
“Try to get that full 7 to 8 hours.”
Transcript evidence from Magen Wu -- Hustle and Flow: Dealing With Burnout in Security.
Said by Magen Wu ·
“Then, move around a little bit.”
Transcript evidence from Magen Wu -- Hustle and Flow: Dealing With Burnout in Security.
Said by Chris Romeo ·
“In my experience, that's something that I've, I've dealt with this burnout thing in the last, I don't know, in the last 6 months or so, leading right up until the first of this year.”
Transcript evidence from Magen Wu -- Hustle and Flow: Dealing With Burnout in Security.
Said by Katy Anton ·
“In the case of Java, you need to write a piece of code to forbid parsing external entities.”
Transcript evidence from Katy Anton -- OWASP Top 10 #4 XXE.
Said by Katy Anton ·
“From a security point of view, if you have a choice, then JSON is the preferred format.”
Transcript evidence from Katy Anton -- OWASP Top 10 #4 XXE.
Said by Katy Anton ·
“When it comes to JSON, the other thing that I usually say is to use to manipulate JSON objects to use a well-known library that hasn't any known vulnerabilities.”
Transcript evidence from Katy Anton -- OWASP Top 10 #4 XXE.
Said by Chris Romeo ·
“The last advice I'm going to give them is you should go find every one of these types of tools best of breed, and you should deploy them all”
Transcript evidence from Pete Chestna -- SAST, DAST, and IAST. Oh My!.
Said by Pete Chestna ·
“You're gonna find a lot of stuff that you're not gonna like, and the fact that you found it is good, and you're gonna need to find some way to get after it.”
Transcript evidence from Pete Chestna -- SAST, DAST, and IAST. Oh My!.
Said by Pete Chestna ·
“Bring these metrics together so that you understand the value of the tools that you bring in and whether they are adding or subtracting”
Transcript evidence from Pete Chestna -- SAST, DAST, and IAST. Oh My!.
Said by Irene Michlin ·
“Check that it tells the story of what your system does.”
Transcript evidence from Irene Michlin -- We Are Not Making It Worse.
Said by Irene Michlin ·
“Make sure you're not making a hole any deeper than it already is.”
Transcript evidence from Irene Michlin -- We Are Not Making It Worse.
Said by Irene Michlin ·
“Some of them, some of them are not suitable to be a functional story and you need to find other ways of recording this work to keep it visible.”
Transcript evidence from Irene Michlin -- We Are Not Making It Worse.
Said by Bill Sempf ·
“That's a interesting question, and I'm going to double back for a minute to a little bit more, a little bit, one other piece of my analysis is all the other weird deserialization pieces that I ran into.”
Transcript evidence from Bill Sempf -- Insecure Deserialization.
Said by Bill Sempf ·
“It's even worse on the data deserialization side because, man, we've got so much old code out there that's dependent on the developers encoding a dataset in.NET and tossing it in a cookie or tossing it in a hidden input.”
Transcript evidence from Bill Sempf -- Insecure Deserialization.
Said by Bill Sempf ·
“There are some tools for both of those that will assist you with deserialization, and you can look at the objects.”
Transcript evidence from Bill Sempf -- Insecure Deserialization.
Said by Chris Romeo ·
“If you work in a product company, who are the people that you need first to build security into your products?”
Transcript evidence from Chris and Robert -- Security Champions.
Said by Robert Hurlbut ·
“Security can be considered by some as a nonfunctional requirement.”
Transcript evidence from Chris and Robert -- Security Champions.
Said by Chris Romeo ·
“I guess the last part, what we wanted to enlighten our listeners on is if somebody happens to be listening here and they're thinking, hey, I want to set up a security champion program, where do they start?”
Transcript evidence from Chris and Robert -- Security Champions.
Said by Kevin Greene ·
“Well, first of all, shifting left, in industries, you have to be somewhat think about things in a realistic way because a lot of buzzwords, a lot of different jargons are always thrown around and people don't quite understand it.”
Transcript evidence from Kevin Greene -- Shifting left.
Said by Kevin Greene ·
“I heard this term codify intuition, and as I started watching the video, I was like, wow, okay.”
Transcript evidence from Kevin Greene -- Shifting left.
Said by Kevin Greene ·
“That's the whole notion of using CAPEC and ATT&CK to build good, misuse cases to see, to see if whatever is being offered up can be abused in a way that compromises security before it's designed, right?”
Transcript evidence from Kevin Greene -- Shifting left.
Said by Robert Hurlbut ·
“The Threat Dragon approach is to boil that down to the fundamentals, so you have the straightforward types of elements, not enriched in any particular way, so it's simple to get you drawing your diagrams out, understanding the data flows quickly without having to try and figure out, well,”
Transcript evidence from Conclusion: OWASP is for everyone.
Said by Chris Romeo ·
“Another area is implement identity and authentication controls.”
Transcript evidence from Conclusion: OWASP is for everyone.
Said by Robert Hurlbut ·
“But we want to make them more, like, app-focused things where it's, like, these little apps that you can test on, like, understand, all right, this is an HTTP/2.0 app.”
Transcript evidence from Conclusion: OWASP is for everyone.
Said by Chris Romeo ·
“All the container technologies will typically show the steps of how they did the build.”
Transcript evidence from Brian Andrzejewski -- Containers Again.
Said by Chris Romeo ·
“For a dev, they can run that container at that local— on their localhost as long as they have their mocks to help with the data side.”
Transcript evidence from Brian Andrzejewski -- Containers Again.
Said by Brian Andrzejewski ·
“I learned quite a bit about containers that I didn't realize, and I'm going to go start telling anyone in the IoT space, Brian said you should look at this maturity model and you should build your software in containers so that it's signed and don't make it run as root and control your system calls.”
Transcript evidence from Brian Andrzejewski -- Containers Again.
Said by Chris Romeo ·
“Understanding it, setting the right expectations, and how to continuously manage a WAF device.”
Transcript evidence from Tin Zaw -- ModSecurity and #AppSec.
Said by Chris Romeo ·
“You can get started with that core rule set.”
Transcript evidence from Tin Zaw -- ModSecurity and #AppSec.
Said by Chris Romeo ·
“If you have like a custom vulnerability or some custom policy that you want to enforce.”
Transcript evidence from Tin Zaw -- ModSecurity and #AppSec.
Said by Chris Romeo ·
“Write that rule to block that vulnerability from being exploited.”
Transcript evidence from Tin Zaw -- ModSecurity and #AppSec.
Said by Chris Romeo ·
“You need to blacklist the rest of the traffic, but only whitelist the proxy”
Transcript evidence from Tin Zaw -- ModSecurity and #AppSec.
Said by Chris Romeo ·
“You've got like different things— hardware, embedded devices, radio communication, mobile app, web dashboard, all of that. So not a single developer can focus on all of those particular areas, right? So you have different teams working on different things, and if they don't coordinate properly, you'll end up having issues between the communication of 2 components.”
Transcript evidence from Aditya Gupta -- The Exploitation of IoT.
Said by Chris Romeo ·
“If threat modeling and the initial planning is done correctly, that can help reduce a lot of security issues.”
Transcript evidence from Aditya Gupta -- The Exploitation of IoT.
Said by Chris Romeo ·
“OWASP has like an embedded security guide. So they can follow that while building embedded devices.”
Transcript evidence from Aditya Gupta -- The Exploitation of IoT.
Said by Chris Romeo ·
“You have to dig deep into the documentation, figure out what are the different security features that they allow you to do.”
Transcript evidence from Aditya Gupta -- The Exploitation of IoT.
Said by Chris Romeo ·
“That is one of the things that comes in the design process, like how much flexibility do we have to give to the users in order to have them control the, the firmware upgrades or change the default creds on the device or those things.”
Transcript evidence from Aditya Gupta -- The Exploitation of IoT.
Said by Speaker not identified ·
“The proactive controls are targeted for developers and are created by developers.”
Transcript evidence from Jim Manico and Katy Anton -- The Future of the OWASP Proactive Controls.
Said by Speaker not identified ·
“More from community feedback as well, and get some data so we can make sure we're picking the right categories.”
Transcript evidence from Jim Manico and Katy Anton -- The Future of the OWASP Proactive Controls.
Said by Speaker not identified ·
“It's meant to be a big requirement database so you can go through a forking process and build your own standard.”
Transcript evidence from Jim Manico and Katy Anton -- The Future of the OWASP Proactive Controls.
Said by Speaker not identified ·
“If you're saying you need to test access controls, tools don't do that.”
Transcript evidence from Andrew van der Stock and Brian Glas -- The Future of the OWASP Top 10.
Said by Speaker not identified ·
“It's literally things about how to do input validation, how to do good crypto, how to do solid authentication and things like that.”
Transcript evidence from Andrew van der Stock and Brian Glas -- The Future of the OWASP Top 10.
Said by Speaker not identified ·
“We're going to be working in GitHub, so anyone who's truly interested in following us for whatever reason, like day by day, they can follow us at GitHub and see where we're at.”
Transcript evidence from Andrew van der Stock and Brian Glas -- The Future of the OWASP Top 10.
Said by Speaker not identified ·
“Because essentially it's an awareness document, and it's treated as a baseline. It's that starting point, and we can't emphasize that enough. This is a starting point.”
Transcript evidence from Andrew van der Stock and Brian Glas -- The Future of the OWASP Top 10.
Said by Robert Hurlbut ·
“It should be one of the first things that you do.”
Transcript evidence from Robert Hurlbut -- Threat Modeling.
Said by Robert Hurlbut ·
“Try to gather a team.”
Transcript evidence from Robert Hurlbut -- Threat Modeling.
Said by Robert Hurlbut ·
“Take 1 or 2 services and figure out the threat model for that 1 service or 2 services.”
Transcript evidence from Robert Hurlbut -- Threat Modeling.
Said by Robert Hurlbut ·
“It's still input. It's still input to our system.”
Transcript evidence from Robert Hurlbut -- Threat Modeling.
Said by Robert Hurlbut ·
“Make it something that you continue to revisit time and time again.”
Transcript evidence from Robert Hurlbut -- Threat Modeling.
Said by Chris Romeo ·
“Your system should support all the way up to 64-character passwords.”
Transcript evidence from Chris and Robert -- Passwords, Identity, and #AppSec.
Said by Chris Romeo ·
“The NIST standard is saying don't do that anymore.”
Transcript evidence from Chris and Robert -- Passwords, Identity, and #AppSec.
Said by Chris Romeo ·
“Your authentication system should have some type of a some type of a tie-in to those hashes that have been dumped before.”
Transcript evidence from Chris and Robert -- Passwords, Identity, and #AppSec.
Said by Speaker not identified ·
“They talk about what APIs are, how they're used, and some of the threats involved with them.”
Transcript evidence from Tanya Janca and Nicole Becher -- Hacking APIs and Web Services with DevSlop.
Said by Chris Romeo ·
“Some APIs that serve up a lot of data, like social media stuff, they'll have pretty generous rate limiting on that.”
Transcript evidence from Tanya Janca and Nicole Becher -- Hacking APIs and Web Services with DevSlop.
Said by Chris Romeo ·
“We're like working with them to like, give them better targets to like test their scanner against.”
Transcript evidence from Tanya Janca and Nicole Becher -- Hacking APIs and Web Services with DevSlop.
Said by Speaker not identified ·
“You either need to integrate with this, use that, or to fix those bugs.”
Transcript evidence from Jon Mccoy and Jonathan Marcil -- Agile #AppSec.
Said by Speaker not identified ·
“My thought is that you must start Agile when your DevOps is ready.”
Transcript evidence from Jon Mccoy and Jonathan Marcil -- Agile #AppSec.
Said by Speaker not identified ·
“Because most of the times it will be all about, yes, you need to fix those bugs, especially if you go with one pen test, right?”
Transcript evidence from Jon Mccoy and Jonathan Marcil -- Agile #AppSec.
Said by Jay Beale ·
“The next thing along the lines of container breakout is, and this one's probably the absolute most important, is you have to use an unprivileged container.”
Transcript evidence from Jay Beale -- Docker Security and AppSec.
Said by Jay Beale ·
“Even when you've got a package manager for the container, you have to start realizing, well, wait, am I using a package manager for my web app framework, for Ruby on Rails, or my package manager for Python, or my package manager, npm for JavaScript, and trying to track all of those?”
Transcript evidence from Jay Beale -- Docker Security and AppSec.
Said by Jay Beale ·
“Make sure that the containers can never— make sure the containers can't reach the host and they can't reach each other.”
Transcript evidence from Jay Beale -- Docker Security and AppSec.
Said by Chris Romeo ·
“Um, as I'm scanning down the list of the changes here and looking at the document, and so folks know, the Proactive Controls, they're making this update as a public Google Doc that anybody can add comments to and anybody can suggest changes to in real time.”
Transcript evidence from Chris and Robert -- Proactive Controls, AppSec USA, and Gartners MQ on AppSec Testing.
Said by Chris Romeo ·
“But we recommend that folks get out there and contribute along the way.”
Transcript evidence from Chris and Robert -- Proactive Controls, AppSec USA, and Gartners MQ on AppSec Testing.
Said by Chris Romeo ·
“We may schedule an impromptu meetup or something depending on how many people we learn that are running around AppSec USA.”
Transcript evidence from Chris and Robert -- Proactive Controls, AppSec USA, and Gartners MQ on AppSec Testing.
Said by Robert Hurlbut ·
“They certainly can learn about what else is going on out there in the security world.”
Transcript evidence from Robert Hurlbut -- Blackhat Security Conference.
Said by Robert Hurlbut ·
“But again, I think it comes out to balance, understanding both sides, understanding how we could work together.”
Transcript evidence from Robert Hurlbut -- Blackhat Security Conference.
Said by Robert Hurlbut ·
“Certainly, I went to one session, it was called Day Zero, which was all about— and that was the eve before Black Hat started— and that was all about trying to help people who are new to Black Hat, help them understand the history.”
Transcript evidence from Robert Hurlbut -- Blackhat Security Conference.
Said by Chris Romeo ·
“It's a minimum set of hygiene that every team should think about as they're either working on a new development project or some added functionality to an existing product.”
Transcript evidence from Dave Ferguson -- The OWASP Top 10 Proactive Controls.
Said by Chris Romeo ·
“You have to think about what does the application allow to be done that shouldn't be happening or shouldn't be allowed.”
Transcript evidence from Dave Ferguson -- The OWASP Top 10 Proactive Controls.
Said by Chris Romeo ·
“The devil's in the details though because encoding the data is not as simple as it seems because sometimes you have to use HTML encoding, sometimes you have to use HTML attribute encoding, sometimes you have to use JavaScript escaping.”
Transcript evidence from Dave Ferguson -- The OWASP Top 10 Proactive Controls.
Said by Jim Manico ·
“If you have already invested in it, and are hesitant to rip it out, yeah, you can keep using the SAPI, get the latest updates that were pushed out a couple months ago.”
Transcript evidence from Jim Manico -- MORE OWASP!.
Said by Jim Manico ·
“But I take responsibility for trying to get this library into at least Java EE, at least the Enterprise Edition.”
Transcript evidence from Jim Manico -- MORE OWASP!.
Said by Jim Manico ·
“They're usually using a modern framework.”
Transcript evidence from Jim Manico -- MORE OWASP!.
Said by Mike Goodwin ·
“It's simple to get you drawing your diagrams out, understanding the data flows quickly”
Transcript evidence from Mike Goodwin -- The OWASP Threat Dragon.
Said by Mike Goodwin ·
“Have the people, the teams, the threat modeling teams discuss them, critically evaluate them”
Transcript evidence from Mike Goodwin -- The OWASP Threat Dragon.
Said by Mike Goodwin ·
“If unmitigated threats become issues, then as they close, the threat model is up to date.”
Transcript evidence from Mike Goodwin -- The OWASP Threat Dragon.
Said by Mike Goodwin ·
“It's important, I think, that it sits close to the code.”
Transcript evidence from Mike Goodwin -- The OWASP Threat Dragon.
Said by Mike Goodwin ·
“Do you realize you've done this commit, but the last time the threat model was updated was a month ago?”
Transcript evidence from Mike Goodwin -- The OWASP Threat Dragon.
Said by Chris Romeo ·
“You need to go through the documentation, work with the company, figure out a way to tune that tool for your environment.”
Transcript evidence from Mark Willis -- I Just Like Static Analysis. Static Analysis is My Favorite.
Said by Mark Willis ·
“Turn on the SQL injection rules and turn everything else off in the beginning.”
Transcript evidence from Mark Willis -- I Just Like Static Analysis. Static Analysis is My Favorite.
Said by Chris Romeo ·
“In that type of environment, I think you have to say, we're going after the criticals and highs.”
Transcript evidence from Mark Willis -- I Just Like Static Analysis. Static Analysis is My Favorite.
Said by Chris Romeo ·
“You want to weed out the false positives.”
Transcript evidence from Mark Willis -- I Just Like Static Analysis. Static Analysis is My Favorite.
Said by Chris Romeo ·
“You have to pick and choose your targets carefully.”
Transcript evidence from Mark Willis -- I Just Like Static Analysis. Static Analysis is My Favorite.
Said by Chris Romeo ·
“Regular software engineers go through as they try to adapt and integrate security into their everyday work.”
Transcript evidence from Eric Johnson -- Continuous Integration in .NET.
Said by Chris Romeo ·
“A lot of it is understanding why we should care”
Transcript evidence from Eric Johnson -- Continuous Integration in .NET.
Said by Chris Romeo ·
“It can pull from your Git repo now, and now it can then launch a build, and we can evaluate the results of the build within Jenkins.”
Transcript evidence from Eric Johnson -- Continuous Integration in .NET.
Said by Matt Clapham ·
“We need to plan time for removal.”
Transcript evidence from Matt Clapham -- The Technical Debt Ceiling.
Said by Matt Clapham ·
“A tech debt that you've identified as part of your project should go on the backlog.”
Transcript evidence from Matt Clapham -- The Technical Debt Ceiling.
Said by Matt Clapham ·
“If you can't write clean code that, passes the static analysis system, then it bumps back, kicks out your change, and you have to go back and fix it.”
Transcript evidence from Matt Clapham -- The Technical Debt Ceiling.
Said by Matt Clapham ·
“Upgrade wisely and often.”
Transcript evidence from Matt Clapham -- The Technical Debt Ceiling.
Said by Matt Clapham ·
“Have a debt ceiling so that as you're building up this tech debt, right, you're going to have some thing on your backlog.”
Transcript evidence from Matt Clapham -- The Technical Debt Ceiling.
Said by Chris Romeo ·
“You have to have an access control approach or design and then you have to implement that throughout your application.”
Transcript evidence from Chris and Robert -- Controversy within the OWASP Top 10 RC.
Said by Robert Hurlbut ·
“Whitelisting, which says everything is locked down until I allow access.”
Transcript evidence from Chris and Robert -- Controversy within the OWASP Top 10 RC.
Said by Chris Romeo ·
“You have to have scripts and things that assist you in the deployment. You have to have a standard approach to deploying.”
Transcript evidence from Chris and Robert -- Controversy within the OWASP Top 10 RC.
Said by Chris Romeo ·
“It's about using standards, using existing frameworks to protect that sensitive data.”
Transcript evidence from Chris and Robert -- Controversy within the OWASP Top 10 RC.
Said by Chris Romeo ·
“The application should have something within it to help it detect, log, respond to, and even block security attacks that are happening.”
Transcript evidence from Chris and Robert -- Controversy within the OWASP Top 10 RC.
Said by Brook S.E. Schoenfield ·
“You have to build an encryption capability or you have to build— and then you have the problem of what you do with the crypto keying materials, the things that make the encryption.”
Transcript evidence from Brook S.E. Schoenfield -- Security in the Design and Architecture.
Said by Brook S.E. Schoenfield ·
“One of the things I always do when I get a job is I run around and find out what the risk tolerance is.”
Transcript evidence from Brook S.E. Schoenfield -- Security in the Design and Architecture.
Said by Brook S.E. Schoenfield ·
“I want to talk to architects. I want to talk to people on the ground, who are building things to get a sense of what they think, where their frustrations—”
Transcript evidence from Brook S.E. Schoenfield -- Security in the Design and Architecture.
Said by Brook S.E. Schoenfield ·
“There has to be, if you need a security expert, they are available to you.”
Transcript evidence from Brook S.E. Schoenfield -- Security in the Design and Architecture.
Said by Brook S.E. Schoenfield ·
“You get stories, security stories built onto the backlog.”
Transcript evidence from Brook S.E. Schoenfield -- Security in the Design and Architecture.
Said by Robert Hurlbut ·
“When I say think like a hacker or think like an attacker, what I'm thinking about is how would I break this system, right?”
Transcript evidence from Conclusion: The End…of Season 1.
Said by Robert Hurlbut ·
“Then afterwards, he politely came out and said, "Can I talk to you for a second?" And said, "I didn't appreciate when you said think like an attacker." Oh no!”
Transcript evidence from Conclusion: The End…of Season 1.
Said by Chris Romeo ·
“But one of the things that I did in my time there was I focused on building this thing that we call security community.”
Transcript evidence from Conclusion: The End…of Season 1.
Said by Speaker not identified ·
“I'm going to work to understand your context.”
Transcript evidence from Rafal Los, James Jardine, and Michael Santarcangelo -- #DtSR and What Makes a Good Security Consultant?.
Said by Speaker not identified ·
“You got to work hard every day to earn that trust from the people that you consult for”
Transcript evidence from Rafal Los, James Jardine, and Michael Santarcangelo -- #DtSR and What Makes a Good Security Consultant?.
Said by Speaker not identified ·
“We have to bring the ability to listen”
Transcript evidence from Rafal Los, James Jardine, and Michael Santarcangelo -- #DtSR and What Makes a Good Security Consultant?.
Said by Speaker not identified ·
“You need to make that investment.”
Transcript evidence from Rafal Los, James Jardine, and Michael Santarcangelo -- #DtSR and What Makes a Good Security Consultant?.
Said by Speaker not identified ·
“What's the problem we're trying to solve”
Transcript evidence from Rafal Los, James Jardine, and Michael Santarcangelo -- #DtSR and What Makes a Good Security Consultant?.
Said by Adam Shostack ·
“When I say think like a hacker or think like an attacker, what I'm thinking about is how would I break this system, right?”
Transcript evidence from Adam Shostack -- Think like an Attacker or Accountant?.
Said by Adam Shostack ·
“A bunch of different ways to ask the question, what could go wrong here?”
Transcript evidence from Adam Shostack -- Think like an Attacker or Accountant?.
Said by Adam Shostack ·
“You can integrate static analysis. build that in, you can do something else, and there's some engineering up front and there's some maintenance, but there's never enough time to do it all.”
Transcript evidence from Adam Shostack -- Think like an Attacker or Accountant?.
Said by Jon Mccoy ·
“I would bake it from the concept of the story level where you're doing a unit test for a SQL record push, but we can do a unit test for SQL injection.”
Transcript evidence from Jon McCoy -- The Mindset to Reverse Engineer.
Said by Jon Mccoy ·
“You need to understand the different paradigms of coding.”
Transcript evidence from Jon McCoy -- The Mindset to Reverse Engineer.
Said by Jon Mccoy ·
“Poke around your own system and find an app that you care about, something like your VPN, your communication software, your messaging software, and pull it apart and see what it does.”
Transcript evidence from Jon McCoy -- The Mindset to Reverse Engineer.
Said by Jon Mccoy ·
“You can drag a random executable into Visual Studio, like a DLL or executable from SQL Server Management Studio, and start coding against it.”
Transcript evidence from Jon McCoy -- The Mindset to Reverse Engineer.
Said by Jon Mccoy ·
“Come and hit up community people.”
Transcript evidence from Jon McCoy -- The Mindset to Reverse Engineer.
Said by Chris Romeo ·
“We have to build security in and push to the left side.”
Transcript evidence from Chris Romeo -- AppSec Awareness: A Blue Print for Security Culture Change.
Said by Chris Romeo ·
“You have to write something down to say— you can't — security culture change is not going to fall out on you.”
Transcript evidence from Chris Romeo -- AppSec Awareness: A Blue Print for Security Culture Change.
Said by Chris Romeo ·
“They look at our content and decide what do we need to change to better resonate with different types of learners that are out there.”
Transcript evidence from Chris Romeo -- AppSec Awareness: A Blue Print for Security Culture Change.
Said by Tracy Maleeff ·
“Your very first thought would be, what can I do for them?”
Transcript evidence from Tracy Maleeff -- Natural Paranoia as a Career Path? A Transition to Security.
Said by Tracy Maleeff ·
“Volunteer to Work on something with OWASP.”
Transcript evidence from Tracy Maleeff -- Natural Paranoia as a Career Path? A Transition to Security.
Said by Tracy Maleeff ·
“Search by InfoSec hashtags even, and follow things.”
Transcript evidence from Tracy Maleeff -- Natural Paranoia as a Career Path? A Transition to Security.
Said by Tracy Maleeff ·
“Go to meetup.com, see what's in your area, go to BSides events.”
Transcript evidence from Tracy Maleeff -- Natural Paranoia as a Career Path? A Transition to Security.
Said by Tracy Maleeff ·
“You need to understand where security as an industry came from to fully appreciate and get where it is now and where it's going.”
Transcript evidence from Tracy Maleeff -- Natural Paranoia as a Career Path? A Transition to Security.
Said by Chris Romeo ·
“If you have that one person that is passionate about security, that's all you need to start.”
Transcript evidence from Chris Romeo -- Security Community at Any Scale.
Said by Chris Romeo ·
“What you can do is over a lunchtime session, which might even be easier for a small company because you can order a couple of pizzas and invite 20 people to come and listen and have a little conversation about security.”
Transcript evidence from Chris Romeo -- Security Community at Any Scale.
Said by Chris Romeo ·
“I've had a lot of success in the past by making that a virtual role.”
Transcript evidence from Chris Romeo -- Security Community at Any Scale.
Said by Chris Romeo ·
“You have to find the people that are already into it and use them as the foundational building blocks of your program.”
Transcript evidence from Chris Romeo -- Security Community at Any Scale.
Said by Chris Romeo ·
“You have to establish that monthly training session.”
Transcript evidence from Chris Romeo -- Security Community at Any Scale.
Said by Deidre Diamond ·
“Must expose the vision and the mission and the plans of the business To all technologists, such that— and to everybody in the company, quite frankly— such that there is harmony and people don't walk into boardrooms speaking a different language.”
Transcript evidence from Deidre Diamond -- The Soft Skills of AppSec.
Said by Deidre Diamond ·
“Go to an improv event where you can practice being uncomfortable because Until that uncomfortableness goes away, one's not gonna love, the art of communication.”
Transcript evidence from Deidre Diamond -- The Soft Skills of AppSec.
Said by Deidre Diamond ·
“That's the measurable agreements.”
Transcript evidence from Deidre Diamond -- The Soft Skills of AppSec.
Said by Tony UcedaVelez ·
“I have a checklist of things that you need to check for, but I don't know what technology set you're using.”
Transcript evidence from Tony UcedaVelez -- PASTA: Not Just for Breakfast Anymore.
Said by Chris Romeo ·
“Think like a security person versus think like a hacker.”
Transcript evidence from Tony UcedaVelez -- PASTA: Not Just for Breakfast Anymore.
Said by Tony UcedaVelez ·
“Security professionals within organizations that are alongside these product managers and developers need to start to have their stethoscope to good, credible threat intel that is correlated to the application frameworks that their developers are using”
Transcript evidence from Tony UcedaVelez -- PASTA: Not Just for Breakfast Anymore.
Said by Glenn Leifheit ·
“I think you need to adapt to whatever that business is.”
Transcript evidence from Glenn Leifheit -- An Inner Glimpse of the Microsoft SDL.
Said by Glenn Leifheit ·
“But treating them as if they're the customer completely changes your dynamic with them.”
Transcript evidence from Glenn Leifheit -- An Inner Glimpse of the Microsoft SDL.
Said by Glenn Leifheit ·
“What's your process? How does it work? How can we fit into your process?”
Transcript evidence from Glenn Leifheit -- An Inner Glimpse of the Microsoft SDL.
Said by Glenn Leifheit ·
“Now we're at 2.5 hours.”
Transcript evidence from Glenn Leifheit -- An Inner Glimpse of the Microsoft SDL.
Said by Glenn Leifheit ·
“We— the problem at a security level, one of the things that I fear for most people is we try to use that capital way before we've earned it.”
Transcript evidence from Glenn Leifheit -- An Inner Glimpse of the Microsoft SDL.
Said by Mike Landeck ·
“If I can demonstrate it to you and show you how you may be vulnerable and a very inexpensive way to fix it, you're very likely to fix it.”
Transcript evidence from Mike Landeck -- Security Must Meet the Needs of the Business.
Said by Mike Landeck ·
“Before you check in your code, you scan it and make sure it will pass.”
Transcript evidence from Mike Landeck -- Security Must Meet the Needs of the Business.
Said by Mike Landeck ·
“My job is to explain the vulnerability, explain the impact, provide some examples, And hopefully, if I'm good at my job, provide here's what the mitigation would be and here's how much mitigation would cost.”
Transcript evidence from Mike Landeck -- Security Must Meet the Needs of the Business.
Said by Daniel Ramsbrock ·
“I always start out with trying to gather as much information as I can about the application and its immediate environment, any dependencies that it has or components that it interacts with on the backend.”
Transcript evidence from Daniel Ramsbrock -- Web Application Pen Testing – Part 2.
Said by Daniel Ramsbrock ·
“Usually there's at least a regular user role Sometimes there's an admin role and, and if the application is more involved than that, there might be other in-between roles that have, more privileges than a regular user but not quite admin privileges.”
Transcript evidence from Daniel Ramsbrock -- Web Application Pen Testing – Part 2.
Said by Daniel Ramsbrock ·
“They have an application called WebGoat, and it's, it's an application that you can, download and install in a VM, and you can start, and so you're not hitting anybody else's environment, you're, attacking it in your own your own localhost.”
Transcript evidence from Daniel Ramsbrock -- Web Application Pen Testing – Part 2.
Said by Daniel Ramsbrock ·
“To me, the waterfall methodology lends itself most to the traditional approach to pen testing, which, most organizations will test their key apps, once a year or so.”
Transcript evidence from Daniel Ramsbrock -- Web Application Pen Testing – Part 1.
Said by Daniel Ramsbrock ·
“I definitely think that there's pros and cons to both approaches, and I think that ultimately most organizations end up with some hybrid model because it makes the most sense.”
Transcript evidence from Daniel Ramsbrock -- Web Application Pen Testing – Part 1.
Said by Daniel Ramsbrock ·
“They don't attack any systems, whether don't have explicit permission, and they always report their findings, to the vendor with plenty of lead time to have to perform a fix before they would publish their results to the wider community.”
Transcript evidence from Daniel Ramsbrock -- Web Application Pen Testing – Part 1.
Said by Matt Clapham ·
“You need to understand why is somebody asking to use this thing.”
Transcript evidence from Matt Clapham -- Development Security Maturity.
Said by Matt Clapham ·
“Talk, ask them something like, what's your favorite programming language?”
Transcript evidence from Matt Clapham -- Development Security Maturity.
Said by Chris Romeo ·
“Give them a quick 2 or 3 sentence answer to that so that they can be appeased.”
Transcript evidence from Matt Clapham -- Development Security Maturity.
Said by Elena Elkina ·
“For example, very often, privacy law allows you to do many different things, but companies get in trouble how they describe to the customers or to the end users what they do with data.”
Transcript evidence from Elena Elkina -- Privacy and Data Protection.
Said by Elena Elkina ·
“Developers play an instrumental role in this process because very often privacy and security controls to protect personal information required for a particular process or application or product are ignored or left to the end of the product development cycle.”
Transcript evidence from Elena Elkina -- Privacy and Data Protection.
Said by Elena Elkina ·
“Unfortunately for privacy professionals, very often we hear it depends and developers get frustrated and I understand why.”
Transcript evidence from Elena Elkina -- Privacy and Data Protection.
Said by Chris Romeo ·
“To summarize what I, what I took away from the description you provided of agile in general, some of the advantages to agile are that you can make changes.”
Transcript evidence from Chris and Robert -- Security in the Methodology.
Said by Chris Romeo ·
“When I think about AppSec in the agile world, I think that the security activities have to happen at a different frequency.”
Transcript evidence from Chris and Robert -- Security in the Methodology.
Said by Chris Romeo ·
“Yes, so I think that the important thing here Regardless of the methodology that you use, the important thing here is to understand what are the security activities that need to be done, what are the steps that exist in our methodology that our company is deciding to use or our team is deciding to use, and then”
Transcript evidence from Chris and Robert -- Security in the Methodology.
Said by Robert Hurlbut ·
“You need to write something down, and I agree, and that's what I've seen as well, that it's important to have some concrete place or something, piece of paper, whatever it is, to keep track of those requirements that you've determined or the features of the system, if you will.”
Transcript evidence from Chris and Robert -- The Activities of the Secure Development Lifecycle.
Said by Robert Hurlbut ·
“The threat modeling aspect of this is understanding your system, understanding the potential threats in that system, and then figuring out ways to mitigate those or create countermeasures, and then, plan out that as essentially your design of your system.”
Transcript evidence from Chris and Robert -- The Activities of the Secure Development Lifecycle.
Said by Chris Romeo ·
“You need to invest the time and the resources in any tool that you're going to use to tune it, to make sure you provide the best possible output for the developers to focus their time and the information that you're putting in front of them so you're not wasting their time.”
Transcript evidence from Chris and Robert -- The Activities of the Secure Development Lifecycle.
Said by Robert Hurlbut ·
“Putting in the controls appropriately and designing that way from the beginning”
Transcript evidence from Chris and Robert -- Introductions and why #AppSec?.
Said by Chris Romeo ·
“You have to be deliberate to ensure that you have a secure coding approach”
Transcript evidence from Chris and Robert -- Introductions and why #AppSec?.
Said by Robert Hurlbut ·
“You're thinking about some of the misuse cases.”
Transcript evidence from Chris and Robert -- Introductions and why #AppSec?.
Said by Chris Romeo ·
“If someone finds a problem with the software that we've created, they have to have an interface or a way to talk back into our organization.”
Transcript evidence from Chris and Robert -- Introductions and why #AppSec?.
Said by Chris Romeo ·
“You're looking for those security problems during requirements, during design, during the time that you're developing, writing code”
Transcript evidence from Chris and Robert -- Introductions and why #AppSec?.
No recommendations match that filter.