Builders Vs. Breakers AppSec 2012

Builders vs. Breakers is a fast paced highly interactive game show debate style talk. Each topic starts with a short introduction pitting the Builder vs. the Breaker. It is then opened up for audience participation. After taking views from the audience, the audience votes on a winner. Whichever side wins the debate is rewarded and the contest moves on to the next topic.

Our builder is a veteran software developer building security tools for developers. Our breaker is a seasoned pen tester with product management and research experience. Our game show host keeps the discussion moving smoothly ... and has been known to occasionally express the business perspective.

Questions for debate will be posted/gathered on google docs for preview and participation. Building on our fun experiences at DC20 SkyTalks and BSidesChicago 2011/2012 this talk is aimed at getting the audience involved and ultimately thinking about contributing to the broader community.

Transcript

1. Builde Breake AppSec 2012 Edition vs.
2. @miscsecurity Brett Hardin MODERATOR
3. @miscsecurity I REPRESENT YOU Brett Hardin MODERATOR
4. JON Rose uilde
5. Matt Konda Breaker
6. QUICK POLL Builder Breaker ~ OR ~
7. Audience Member 1 Vote & Drink! Question & Debate
8. BUILDER’S CONCERNS Dates Features Functional Quality
9. BREAKER’S CONCERNS LOL’s! VULNS! Compromise!
10. Let’ get in the m d
11. “….developers will never learn, never improve because they are repeating the same mistakes over and over again” reaker
12. “…only good at ranting. Zero contribs, and almost zero constructive feedbacks but bashing” Builde Response
13. “If you are a developer and don’t know who OWASP is at this point, it’s because you’ve chosen not to.” eaker
14. “Problem. Infosec pros, pentesters, etc. are more interested in #appsec than programmers. How to change that? < will not change” ilde
15. “… the developer who did this should be taken out into the street and beaten …” Breaker
16. “Agile: Most security guys are useless” Builde
18. SECURE MAKES ME THE CLOUD
19. Customers Don’t Ask For Security
20. BREACHES are CHEAPER than SECURE CODING
21. Agile Hurts Security
22. DON’T understand DEVELOPMENT Breakers
23. FFFFFFF UUUUUU UUUUUU
24. NEED TO understand VULNERABILITIES Builders
25. WAF SOLVES THE PROBLEM
26. FALSE POSITIVES ARE A NECESSARY EVIL
27. We don’t really feel this way… HARD STANCE OPPOSITE THINKING SAME CONCLUSION?
28. TAKE AWAYS
29. TAKE AWAYS ENGAGE DEVS!
30. TAKE AWAYS ENGAGE DEVS! BE RESPECTFUL
31. TAKE AWAYS ENGAGE DEVS! BE RESPECTFUL GET DIRTY
32. Thanks