The Roundup: AppSec

Abstract: ZAP is the world’s most frequently used web app scanner in no small part due to its support for automation. In the talk Simon will explain the options you have for automating ZAP and the advantages and disadvantages of each. He will explain how you can get quickly and easily get started with ZAP automation and then tune the process so that ZAP can test your applications as effectively as possible. 

Abstract: Building, maintaining, and securing resilient networks is tough… and well beyond the skills and budgets for most orgs. But it doesn’t have to be that way! Project Fantastic is a framework which makes complex tasks much more doable. It gives the power of the command line to those who can’t or won’t allocate the time it takes to learn it. But unlike other abstraction frameworks, Fantastic does NOT hide what’s happening or worse yet… prevent you from understanding what it’s doing… instead Fantastic exposes these inner workings so you can more easily extend the tool, or just directly access the CLI if and when you need it. Attendees of this talk will be introduced to Fantastic, learn how it works, how it can be enhanced, and most importantly, how you can immediately start using this tool to make your life easier. 

Abstract: Security conversations with development teams don’t have to be an uphill battle. In this compelling session, we will discover the underlying challenges app teams face that cause them to seemingly dismiss security concerns, and we will collaboratively find solutions to those problems.

To us as Information Security professionals, it can certainly feel like dev teams don’t care about security. That seems clear in those moments when they proceed with a production deployment despite poor static code analysis results or when they hesitate to add a high-priority security remediation to the product roadmap. However, as a former software engineering manager, I have a different perspective. While I did sometimes postpone security endeavors or push for policy exceptions, I did care about security. The reality was that I faced extreme challenges that my InfoSec team did not see or understand.

Now as an InfoSec leader myself, I realize there is a better way. We must understand the realities in which our app teams live so we can address their core concerns that cause them to push back on us. In this session, we will learn from my experiences on both sides of the table. There are ways we can partner effectively with application teams to achieve the business’s goals and keep the company safe, and together we will learn how.

Abstract: My company has built dozens of web applications that are regularly updated and pushed through the development process. Policy calls for the workflow to include a scan of any application moving between environments. This was becoming an increasingly laborious task, so we did what we had to do, we automated it. In this talk I will talk through the various parts of the automation process, walk through python scripts, cron jobs, and database calls, I will then wrap it up with a front end php page that allows the most basic user to simply click a button and kick off an application scan that will report back the findings, saving teams hours of back and forth communication and headaches. 

Abstract: Imagine pouring your heart and soul into a software build, crafting a new piece of our digital world with all the features, functionality, and user experience that has made modern life so darn convenient. Your work is the envy of your peers, and the code shipped without a hitch. Excellent.

… and then, the gloomy presence of a security specialist tears it all down. They’ve found an exploitable security bug, it’s not ready to ship, and you have to fix your no-good code right away. How dare they call your baby ugly, especially after all your hard work, and despite there being so many non-security elements that were awesome.

For many developers, this is the harsh reality of their experience not just with the AppSec team, but with cybersecurity in general. “Security” has negative connotations for them, and it really isn’t a priority when feature-building must take center stage.

However, catastrophic breaches are only getting worse and more frequent, and the traditional approach of throwing endless AppSec tooling at a human problem clearly isn’t working. Developers need an olive branch from the security team, and they need it yesterday.

In this presentation, Pieter Danhieux will have a look at the current skills from 100,000 developers, revealing the current state of developer-driven security, and how smart organizations can help every engineer avoid the “ugly baby” conversation for good.

Abstract: This presentation will explore the problems embedding security within our applications and organizations because of communication issues. It will also discuss the methods to help fix this important issue.