Inconvenient Truth(s) on Application Security (presented in 2007 and still relevant in 2014)

Here and embedded below is a presentation that I did in 2007 at an SANS conference when I was working for OunceLabs.

Here are the 13 Inconvenient Truth(s) mentioned on that presentation (I'm not sure if I should be encouraged that I made some good points, or depressed on how little progress we have done in Application security over the past 7 years)

• #1 There are no metrics!
• #2 Global Warming ~ Software InSecurity
• #3 Secure software doesn’t make business sense
• #4 Our systems are safe today
• #5 We will be doomed!
• #6 The attacker's business model is still immature
• #7 Physical Extremism doesn't scale (but Digital Extremism does)
• #8 We need better engineering
• #9 We need containment
• #10 Open Source security is a myth
• #11 Most Source Code must be disclosed
• #12 Most IT Security products have negative ROI
• #13 The 'digital Armageddon' will never happen

Here is the first slide where I start with the Inconvenient Truth(s) that Software/Application Security is a mess (in 2007 and today)

Here is the last slide where I mention my 2007 ideas for how to solve the 'Application Security' problem (and unfortunately, ideas that are still very relevant today (in 2014)):

Here is the full presentation:

Inconvenient Truth(s) - On Application Security (from 2007)