Technology often creates new, exciting and more efficient ways of doing business. Adding efficiency and lowering costs frequently creates a strong desire to implement the latest and greatest technology. The downside is that we often jump into new technology without fully considering the security implications, and inadvertently implement the same old vulnerabilities time and time again. We’ve seen it with the Web, Cloud, IoT, etc, etc. In many cases, we have seen that the implementers are not considering security at all, but merely functionality, which leads to a wealth of subtle and not-so-subtle security vulnerabilities. In this interactive discussion, Rob Cheyne will explore some ways that we consistently add risk to our organizations, uncover some ticking time bombs, and discuss some ways to improve the situation. As a group, we will explore ways that we can more proactively build security into our systems and make better risk management decisions within our organizations. "Building a Collaborative & Social Application Security Program" Joe Basirico, N/A N/A In today’s environment there is no arguing that a comprehensive secure development process is necessary. Fitting tools, technology, and security reviews into our current development cycle has become table stakes for companies building the software of tomorrow. Breaking the ”find and fix” vulnerability based assessment cycle so that software is developed with security in mind from start to finish is critically important, but doing this without leveraging a collaborative and social security program that leverages bug bounty programs, security researchers, and every aspect of vulnerability disclosure misses a huge opportunity. In this talk I will explore how your security program can reach beyond the Secure SDLC. We will discuss: Bug Bounty Programs - Why you want to invite security researchers to hack your products Marketing your Security Program - How and why to market your security program. What to say, how to say it, and where to say it for maximum effectiveness. How to Communicate with Security Researchers - What are security researchers expecting in communication, responsiveness, transparency, and time to fix. Vulnerability Disclosure Options - What public vs. responsible disclosure means and how to handle each Integration with an Existing Security Program - You may already be training your developers, using outside vendors, and performing internal security testing, where do these other aspects fit in?