Builders vs. Breakers - AppSec 2012

Security people (breakers) don't understand developers (builders). This presentation is in debate format. The moderator asks questions and the builder and breaker fight it out.

Transcript

1. Builde Breake AppSec 2012 Edition vs.
2. @miscsecurity Brett Hardin MODERATOR
3. @miscsecurity I REPRESENT YOU Brett Hardin MODERATOR
4. JON Rose uilde
5. Matt Konda Breaker
6. QUICK POLL Builder Breaker ~ OR ~
7. Audience Member 1 Vote & Drink! Question & Debate
8. BUILDER’S CONCERNS Dates Features Functional Quality
9. BREAKER’S CONCERNS LOL’s! VULNS! Compromise!
10. Let’ get in the m d
11. “….developers will never learn, never improve because they are repeating the same mistakes over and over again” reaker
12. “…only good at ranting. Zero contribs, and almost zero constructive feedbacks but bashing” Builde Response
13. “If you are a developer and don’t know who OWASP is at this point, it’s because you’ve chosen not to.” eaker
14. “Problem. Infosec pros, pentesters, etc. are more interested in #appsec than programmers. How to change that? < will not change” ilde
15. “… the developer who did this should be taken out into the street and beaten …” Breaker
16. “Agile: Most security guys are useless” Builde
18. SECURE MAKES ME THE CLOUD
19. Customers Don’t Ask For Security
20. BREACHES are CHEAPER than SECURE CODING
21. Agile Hurts Security
22. DON’T understand DEVELOPMENT Breakers
23. FFFFFFF UUUUUU UUUUUU
24. NEED TO understand VULNERABILITIES Builders
25. WAF SOLVES THE PROBLEM
26. FALSE POSITIVES ARE A NECESSARY EVIL
27. We don’t really feel this way… HARD STANCE OPPOSITE THINKING SAME CONCLUSION?
28. TAKE AWAYS
29. TAKE AWAYS ENGAGE DEVS!
30. TAKE AWAYS ENGAGE DEVS! BE RESPECTFUL
31. TAKE AWAYS ENGAGE DEVS! BE RESPECTFUL GET DIRTY
32. Thanks