Presentation: Building AppSec Teams

Here is the presentation I delivered recently at an online SC Conference on Web Application Security.

This is the consolidation of my recent research (and practical experience) of creating AppSec teams.

I think this structure and focus would make a massive difference (if implemented) at a large number of companies (specially the AppSec Squad concept)

The video is available on demand here

Presentation: OWASP Summit 2017 (Jan and Feb updates)

Here are two presentations I delivered recently (at the OWASP London Chapter) about the forthcoming OWASP Summit 2017

Presentation: Security champions

Here is a presentation I delivered recently to a newly created Security Champions team.

The objective was to present them what are Security Champions, and to motivate them into wanting to become one.

Let me know what you think of it, and if there is anything missing from this initial 'motivational' slide deck

Presentation: Legacy-SecDevOps (AppSec Management Debrief)

Here is a presentation I created last year as a debrief to C-Level execs

It is quite strong, but they took it quite well and agreed with most of it :)

Let me know what you think of it (I'm sure you've seen many similar projects and organisations)

Presentation: Veracode Automation CLI (using Jenkins for SDL integration)

Here is a presentation about an secure CI workflow that I'm working on.

The key parts are the Veracode CLI developed (see veracode-api) and the couple Jenkins projects which use the Veracode engine in a 'concurrent scanner' model.

Let me know what you think of it:

Presentation "Hacking Portugal and making it a global player in Software development"

UPDATE: See Hacking Portugal book for an expanded and updated version of these ideas (available from Amazon)

---

Here is the presentation I delivered today at BSidesLisbon

There is an extended version of these ideas on this GitHub repo which you can read online at: https://diniscruz.github.io/keynote-bsideslisbon/

Description: As technology and software becomes more and more important to Portuguese society it is time to take it seriously and really become a player in that world. Application Security can act as an enabler, due to its focus on how code/apps actually work, and its enormous drive on secure-coding, testing, dev-ops and quality. The same way that Portuguese navigators once looked at the unknown sea and conquered it, our new digital navigators must do the same with code. This presentation will provide a number of paths for making Portugal a place where programming, TDD, Open Source, learning how to code, hacking (aka bug bounty style) and DevOps are first class citizens.

Presentation - "SecDevOps Risk Workflow - v0.6", InfoSecWeek, Oct 2016

Slides from presentation delivered at InfoSecWeek in London (Oct 2016) about making developers more productive, embedding security practices into the SDL and ensuring that security risks are accepted and understood.

The focus is on the Dev part of SecDevOps, and on the challenges of creating Security Champions for all DevOps stages.

This presentation is based on the ideas captured on the SecDevOps Risk Workflow book (that I'm currently writing).

Presentation - "Surrogate dependencies (poc in node js) v1.0"

Here is the second part of the presentation I delivered at the OWASP London Chapter event (29 Sep 2016)

Presentation "NodeJS security - still unsafe at most speeds - v1.0"

Here is the first part of the presentation I delivered at the OWASP London Chapter event (29 Sep 2016)

"Turning TDD upside down - For bugs, always start with a passing test" - v0.5 Sep 2016

Here is the presentation I delivered at LSCC (London Software Craftsmanship Community) on the 22nd Sep 2016

Title: Turning TDD upside down - For bugs, always start with a passing test
Description: Common workflow on TDD is to write failed tests. The problem with this approach is that it only works for a very specific scenario (when fixing bugs). This presentation will present a different workflow which will make the coding and testing of those tests much easier, faster, simpler, secure and thorough'

Start with passing tests (tdd for bugs) v0.5 (22 sep 2016) from Dinis Cruz

Using JIRA to manage RISKS - v1.0 - OWASP AppSec EU - June 2016

Here is the presentation I just delivered at OWASP's AppSec EU in Rome

Using jira to manage risks v1.0 - owasp app sec eu - june 2016 from Dinis Cruz

AppSec and Software Quality - Presentation v0.5

Here is a slimmed down version of the presentation I delivered in Italy last March.

This version does not contain the part that talks about the problem (i.e. the attacks and why you need to do Application Security)

The key idea that I defend is that we can use Application Security to define and measure Software Quality

Let me know what you think

"New Era of Software with modern Application Security" presentation (v1.0)

This is the final slide deck of the "New Era of Software with modern Application Security" presentation I delivered at Codemotion Rome, which was a developer-focused conference (with 2000 tickets sold).

Description: "This presentation will start with an overview of the current state of Application Insecurity (with practical examples). This will make the attendees think twice about what is about to happen to their applications. The solution is to leverage a new generation of application security thinking such as: TDD, Docker, Test Automation, Static Analysis, cleaver Fuzzing, JIRA Risk workflows, Kanban, micro web services visualization, and ELK. These practices will not only make applications/software more secure/resilient, but it allow them to be developed in a much more efficient, cheaper and productive"

"New Era of Software with modern Application Security" updated presentation (v.0.6)

Here is the updated version of the talk I delivered last week at the LSCC (this time around delivered at the OWASP London Chapter)

There are a number of new slides, but it is still far from complete :)

Please take a look at the slides and let me know what you think of them? (and what can be improved for the next version)

V0.5 of "New Era of Software with modern Application Security" presentation

Here is my first pass at creating the "New Era of Software with modern Application Security" presentation, which I will deliver as a Keynote at the Codemotion Rome developer conference (March 19th)

This is the version that I presented yesterday at the London Software Craftsmanship Community event and its video is here

Interestingly, one of the concepts that I arrived at (when working on the slides) was that Application Security can be used to define and measure Quality.

This is something that I have been thinking about for a long time, and I'm starting to find a way to explain how I'm able to use Application Security to help developers to create better applications (with not only better security, but with better quality)

Please take a look at the slides and let me know what you think of them? (and what can be improved for the next version)

Speaking at LSCC (18th Feb) on "New Era of Software with modern Application Security"

In preparation to my CodeMotion keynote in March, next week I'm presenting a first version of it at LSCC (London Software Craftsmanship Community) which is also a developed focused audience.

You can register at https://skillsmatter.com/meetups/7845-lscc-talks-feb-2016

Here are the talk details:

Title: New Era of Software with modern Application Security

Description: This presentation will start with an overview of the current state of Application Insecurity (with practical examples). This will make the attendees think twice about what is about to happen to their applications. The solution is to leverage a new generation of application security thinking such as: TDD, Docker, Test Automation, Static Analysis, cleaver Fuzzing, JIRA Risk workflows, Kanban, micro web services visualization, and ELK. These practices will not only make applications/software more secure/resilient, but it allow them to be developed in a much more efficient, cheaper and productive way.

Bio:Dinis is focused on creating Application Security teams and providing Application Security assurance across the SDL (from development, to operations, to business processes, to board-level decisions). His focus is in the alignment of the business’s risk appetite with the reality created by Applications developed internally, outsourced or purchased. He is also an active Developer and Application Security Engineer focused on how to develop secure applications. A key drive is on 'Automating Application Security Knowledge and Workflows' which is the main concept behind the OWASP O2 Platform.

Inconvenient Truth(s) on Application Security (presented in 2007 and still relevant in 2014)

Here and embedded below is a presentation that I did in 2007 at an SANS conference when I was working for OunceLabs.

Here are the 13 Inconvenient Truth(s) mentioned on that presentation (I'm not sure if I should be encouraged that I made some good points, or depressed on how little progress we have done in Application security over the past 7 years)

• #1 There are no metrics!
• #2 Global Warming ~ Software InSecurity
• #3 Secure software doesn’t make business sense
• #4 Our systems are safe today
• #5 We will be doomed!
• #6 The attacker's business model is still immature
• #7 Physical Extremism doesn't scale (but Digital Extremism does)
• #8 We need better engineering
• #9 We need containment
• #10 Open Source security is a myth
• #11 Most Source Code must be disclosed
• #12 Most IT Security products have negative ROI
• #13 The 'digital Armageddon' will never happen

Updated presentation of 'RESTing On Your Laurels will Get YOu Pwned' (RSA version)

At the last RSA conference, Abe and Alvaro presented an updated version of the RESTing On Your Laurels will Get YOu Pwned presentation (originally delivered by me and Abe at DefCon 2013).

Here is the description

Public REST APIs have become mainstream. Now, almost every company that wants to expose services or an application programming interface does it using a publicly exposed REST API. This talk will give participants the skills they need to identify and understand REST vulnerabilities. The findings are a result of reviewing production REST applications as well as researching popular REST frameworks.   

By Abraham Kang, Alvaro Muñoz and Dinis Cruz

In addition to the original demos we did, Alvaro added a nice Metasploit PoC which really should drive home the problem with XStream and XMLDecoder.

"OWASP O2 Platform - Automating Security Knowledge through Unit Tests" presentation

Also just uploaded to SpeakerDeck is the O2 Platform presentation I created in Nov 2010, and have presented many times before:



Humm, I think I should create another Slide Deck for O2 :)  since a lot has changed in the last 18 months (although the key concepts are still there)

 Note:Presentation hosted at SpeakerDeck

"Making Security Invisible by Becoming the Developer's Best Friends" presentation

I just uploaded my "Making Security Invisible by Becoming the Developer's Best Friends" presentation (Oct 2011  at OWASP AppSec Brazil) to SpeakerDeck and it looks really good :)

http://speakerdeck.com/u/diniscruz/p/making-security-invisible-by-becoming-the-developers-best-friends

I'm really linking SpeakerDeck , it just fell right :)

Related Posts:

• Secure coding (and Application Security) must be invisible to developers
• Security evolution into Engineering Productivity