A Logo

Feel free to include my content in your page via my
RSS feed

Help Irongeek.com pay for
bandwidth and research equipment:

Search Irongeek.com:

Irongeek Button
Social-engineer-training Button

Help Irongeek.com pay for bandwidth and research equipment:


Shifting Application Security Left - Craig Stuntz BSides Columbus Ohio 2018 (Hacking Illustrated Series InfoSec Tutorial Videos)

Shifting Application Security Left
Craig Stuntz
BSides Columbus Ohio 2018

Many people agree the best way to avoid security problems in an application is to design security into the architecture from the beginning instead of doing blackbox testing after development is finished. But what does that actually look like in a real-world application development lifecycle? Checklists like the OWASP Top 10 do not tell architects how to best work with infosec professionals or singlehandedly build an application on a secure foundation. Where should a developer even begin? How do you design security into applications based on next week's JavaScript framework, for which no "best practices" exist? The Information Security Practice Principles, developed by Indiana University’s Center for Applied Cybersecurity Research, provide both a foundation for application security independent of specific technology decisions as well as a means for establishing a common language between designers and defenders. We will work through an example of how to apply the principles build a threat model and an application design, and what this looks like in an "agile" software development lifecycle. Security teams can be an enabler for good design, not just a gateway to block mistakes!

I am a software engineer living software engineer and a lifelong student of computer science, with specific interests in programming languages, type theory, compilers, and math. I am Technical Director at Improving in Columbus, OH and co-founded the Columbus branch of Papers We Love, a reading group for people interested in academic computer science research. In my spare time, I play Irish traditional music on the wooden flute and tin whistle.


Back to BSides Columbus Ohio 2018 video list

Printable version of this article

15 most recent posts on Irongeek.com:

If you would like to republish one of the articles from this site on your webpage or print journal please contact IronGeek.

Copyright 2016, IronGeek
Louisville / Kentuckiana Information Security Enthusiast