Builders Vs. Breakers - OWASP MSP Day of Talks

The Builders Vs. Breakers debate brought to the MSP OWASP day of talks. We debate topics pitting developers against security pros to try to illustrate disconnects and areas for improvement.

Transcript

1. Builde Breake OWASP MSP Edition vs.
2. Matt Konda uilde
3. Jon Rose Breaker
4. QUICK POLL Builder Breaker ~ OR ~
5. Audience Member 1 Vote & Drink! Question & Debate
6. BUILDER’S CONCERNS Dates Features Functional Quality
7. BREAKER’S CONCERNS LOL’s! VULNS! Compromise!
8. Let’ get in the m d
9. “….developers will never learn, never improve because they are repeating the same mistakes over and over again” reaker
10. “…only good at ranting. Zero contribs, and almost zero constructive feedbacks but bashing” Builde
11. “If you are a developer and don’t know who OWASP is at this point, it’s because you’ve chosen not to.” eaker
12. uilde “Problem. Infosec pros, pentesters, etc. are more interested in #appsec than programmers. How to change that? < will not change”
13. “… the developer who did this should be taken out into the street and beaten …” Breaker
14. “Agile: Most security guys are useless” Builde
15. eaker “Wow, website doesn’t do special characters for passwords. What kind of moron devs set that up?”
17. SECURE MAKES ME THE CLOUD
20. Customers Don’t Ask For Security
21. BREACHES are CHEAPER than SECURE CODING
22. Agile Hurts Security
26. QA is For Security
27. DON’T understand DEVELOPMENT Breakers
28. FFFFFFF UUUUUU UUUUUU
29. NEED TO understand VULNERABILITIES Builders
30. WAF SOLVES THE PROBLEM
31. FALSE POSITIVES ARE A NECESSARY EVIL
32. A PENTEST VALIDATES SECURITY
33. A PENTEST VALIDATES SECURITY
34. 3rd Party Libraries are Secure
35. The Fixer
36. We don’t really feel this way… HARD STANCE OPPOSITE THINKING SAME CONCLUSION?
37. TAKE AWAYS
38. TAKE AWAYS ENGAGE DEVS!
39. TAKE AWAYS ENGAGE DEVS! BE RESPECTFUL
40. TAKE AWAYS ENGAGE DEVS! BE RESPECTFUL GET DIRTY
41. Thanks