Tell me to push my appsec left one more time: OWASP Proactive Controls

No ratings

Presented at BSidesNashville 2019 by

David Cybuck

It may be true that pushing security left can stop us from developing breakable applications. And it matters how, and what, you push to developers. Even linters or other IDE tools are still not made for developers. Static code analysis output still needs to be translated into use cases or stories. It is meaningless when a tool reports SQL injection vulnerability. "The code meets the specification and design, those stories were closed 3 sprints ago, and QA and regression still pass; there is no bug in any of my use cases," said any developer. OWASP Proactive Controls are what we want to push left. They are a set of actionable security controls, going beyond developer training or static code scanning, that speak to developers. For the talk “our developers” write the OWASP Juice Shop. We will use examples and practice walking them through the OWASP proactive controls.