Practical AppSec - Quick Wins for More Secure Software

Discover practical strategies for enhancing application security in this 37-minute conference talk from LASCON 2014. Learn how to prioritize and implement quick wins to improve your software's security posture with limited resources. Explore various approaches including manual penetration testing, source code review, automated scanning, web application firewalls, threat modeling, and developer training. Gain insights on working effectively with development teams for remediation efforts. Understand how to measure progress and demonstrate improvement using a popular software security maturity model. Walk away with specific, actionable steps to strengthen your applications' security and raise the bar for potential attackers.

Intro
Sabre
About Dave
AppSec Mission
Complications
General Thoughts
Burp
Quick Wins
Finding Attack Surfaces
SSL Configuration
Sequel Injection
Crosssite Scripting
HTTP Response Headers
Engage Developers
AppSec maturity model
Alternatives