Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Prioritizing Trust while Creating Applications

Prioritizing Trust while Creating Applications

Managing risk needs to scale as your product grows in popularity and complexity. In traditional software development, security was often treated as a last gating factor at best and post-incident concern at worst. You need to shift your security processes left—in other words, earlier in the development lifecycle. The cost of applying security practices too late can be catastrophic to a company, leading to the loss of customer trust and affecting the bottom line.

Join Jennifer Davis to gain an overview of security tools and practices to adopt, including the CIA triad and why security matters, motivations of attackers, core foundation practices, defense in depth, threat modeling, making choices in your architecture based on operational concern, testing code, coding standards, securing code reviews, handling incidents, and advanced practices such as bug bounty problems, capture the flag, and red team exercises.

Jennifer Davis

November 06, 2019
Tweet

More Decks by Jennifer Davis

Other Decks in Technology

Transcript

  1. View Slide

  2. View Slide

  3. Trust

    View Slide

  4. Framework
    Choice

    View Slide

  5. https://haveibeenpwned.com/

    View Slide

  6. View Slide

  7. @sigje

    View Slide

  8. Discovery
    Development
    Build
    Release
    Deploy
    Monitor

    View Slide

  9. View Slide

  10. @sigje

    View Slide

  11. Common
    Context

    View Slide

  12. @sigje

    View Slide

  13. View Slide

  14. View Slide

  15. Foundations

    View Slide

  16. View Slide

  17. View Slide

  18. OWASP:
    Application Security Verification Standard Project

    View Slide

  19. View Slide

  20. View Slide

  21. Serverless
    Software
    Platform
    Infrastructure
    On-Prem

    View Slide

  22. View Slide

  23. View Slide

  24. Source: https://www.imperialviolet.org/2014/02/22/applebug.html

    View Slide

  25. View Slide

  26. View Slide

  27. Minimum Viable Response Plan: jhand.co/CreateResponsePlan

    View Slide

  28. View Slide

  29. View Slide

  30. View Slide

  31. Discovery
    Development
    Build
    Release
    Deploy
    Monitor

    View Slide

  32. Advanced
    Topics

    View Slide

  33. View Slide

  34. CTF with Google
    CTF Circle

    View Slide

  35. “Fundamentally, if somebody wants
    to get in, they’re getting in…accept
    that. What we tell clients is:
    Number one, you’re in the fight,
    whether you thought you were or
    not. Number two, you almost
    certainly are penetrated.”

    View Slide

  36. View Slide

  37. @sigje

    View Slide

  38. Build
    Community.
    Bit Community by Ashley McNamara is licensed under CC BY-NC-SA 4.0

    View Slide

  39. Session page on conference website

    View Slide