The 6-Points Strategy to Get Your Applications in Security Shape

No ratings

Presented at BSidesOttawa 2014 by

Sherif Koussa

Let's face it: security is often an afterthought for development teams, often left until the end of the development life cycle and just before going to production. This is particularly an issue when it comes to application security. Deadlines are looming with no time or resources left for any disruptions, especially not another security bug. Teams will more often than not simply do nothing, while even the most proactive ones will only order a quick vulnerability scan to ensure that there are no obvious security problems. Days, months and even years may pass without an incident, until the ugly face of hackers show up and a security incident happens. With exploits making the news headlines daily, it is pretty clear that neither attackers nor security bugs are going anywhere. It is also clear that whatever we are doing today as far as application security (or the lack of) is not working. This presentation will show you, step-by-step, how to introduce application security best practices gradually into your Software Development Life Cycle (SDLC). You will see how your teams can systematically introduce application security best practices such as security code review to their day-to-day development tasks with minimal disruption, learn the essential parts of the security code review process and what are the open-source tools available to use.