January 22, 2020

160 words 1 min read

Great software is secure software

Great software is secure software

If great software is secure software, why are there still so many vulnerabilities? Dont architects and developers want to build great systems? Chris Wysopal details how defenders can enable developers to create secure software through coaching, shared code, and services.
Talk Title Great software is secure software
Speakers Chris Wysopal (Veracode)
Conference O’Reilly Security Conference
Conf Tag Build better defenses
Location New York, New York
Date October 30-November 1, 2017
URL Talk Page
Slides
Video Talk Video

If great software is secure software, why are there still so many vulnerabilities? Don’t architects and developers want to build great systems? Software teams today must move fast to compete in the marketplace. They need to inherit functionality, scale, and performance. Can they inherit security as well? As defenders it is our job to make this inheritance possible. Ideally security inheritance is transparent and inescapable. Chris Wysopal details how defenders can enable developers to create secure software through coaching, shared code, and services.

security code performance
comments powered by Disqus
The impact of design: How design influences outcomes

The impact of design: How design influences outcomes

January 6, 2020

We like to think that technology can make the world a better place, but we (conveniently) forget how it can make it worse. Primum non nocere (first do no harm) is the first concept taught in medical school, serving as a reminder of the possible harm that any intervention might do. Cynthia Savard Saucier challenges the tech industry to come up with its own fundamental principle.
How JupyterHub tamed big science: Experiences deploying Jupyter at a supercomputing center

How JupyterHub tamed big science: Experiences deploying Jupyter at a supercomputing center

December 22, 2019

Shreyas Cholia, Rollin Thomas, and Shane Canon share their experience leveraging JupyterHub to enable notebook services for data-intensive supercomputing on the Cray XC40 Cori system at the National Energy Research Scientific Computing Center (NERSC).
Going serverless: Security outside the box

Going serverless: Security outside the box

January 22, 2020

The advent of serverless technologies and infrastructure as code has changed how we build and deploy security services, empowering teams to create low-cost, scalable, and secure services to protect organizations. Drawing on their real-world experiences, Jack Naglieri and Austin Byers explore tools and techniques for successfully building, deploying, and debugging serverless security applications.
How to launch and run a successful bug bounty program: A security team perspective

How to launch and run a successful bug bounty program: A security team perspective

January 22, 2020

Launching a bug bounty program is hard. Running and maintaining a successful bug bounty program is even harder. Using real-world stories of both failure and success, Alexandra Ulsh details how Mapbox's security team used tools, processes, automation, and empathy to decrease response time by 90%, reduce noise, and improve average report quality for its bug bounty program.
Can we make developers care about operations?

Can we make developers care about operations?

January 20, 2020

Can we make developers care about operations? Jrgen Cito shares real-world experience of developers struggling with operations and details a journey to incorporate runtime performance aspects into the developer's daily workflow and reduce performance problems reaching production.
How secure are Docker containers?

How secure are Docker containers?

January 19, 2020

Docker offers many advantages, simplifying both development and production environments. But there is still uncertainty around the security of containers. Ben Hall answers the question, How secure are Docker containers?, exploring Docker's security model, its limitations, and how to handle them.