We've all seen it. Perhaps some of us have done it. Pentest report comes in. Meeting is convened. Discussion is had. Devs head back to the cubes. And the report vanishes into the dev lead's desk, never to be seen again. Lather rinse and repeat next year. In these forty-five minutes, Bill will give your the basics of how to talk to your dev staff. Twenty-three years of development experience - ten of it as a security specialist - will get laid on the table. We'll cover turning vulns into defects, showing devs how to fix the vulns rather than just showing them off, the lies of severity, and building bridges rather than burning them. Bring your drink of choice - some of this will be rough, but we all need to hear it.

Bill Sempf is an application security architect. His breadth of experience includes business and technical analysis, software design, development, testing, server management and maintenance, and security. In his 20 years of professional experience he has participated in the creation of well over 200 applications for large and small companies, managed the software infrastructure of two Internet service providers, coded complex software happily in every environment imaginable, tested the security of all natures of applications and APs, and made mainframes talk to cell phones. He is the author of C# 5 All in One for Dummies and Windows 8 Programming with HTML5 For Dummies; a coauthor of Effective Visual Studio.NET and many other books, a frequent contributor to industry magazines; and has recently been an invited speaker for the ACM and IEEE, BlackHat, CodeMash, DerbyCon, BSides, DevEssentials, the International XML Web Services Expo and the Association of Information Technology Professionals. Bill also serves on the board of the Columbus branch of the Open Web Application Security Project, and is the Administrative Director of Locksport International

Back to Derbycon 2015 video list