Key concepts like the CIA triad, technical debt, and design principles provide a shared language for discussing security.
Criteria like memory safety, type strictness, and sandbox support help in selecting a language that mitigates entire classes of vulnerabilities by design.
Proper input validation, canonicalization, sanitization, and context-sensitive output encoding are crucial for preventing injection attacks.
Low-level languages require manual bounds checking to prevent buffer overflows, while complete mediation ensures access control is checked on every request.
Use standard, well-vetted cryptographic libraries and follow best practices for session management to protect data and user identity.
Race conditions can lead to data integrity problems, which can be mitigated using techniques like entity versioning or resource locking.
Familiarity with lists like the OWASP Top 10 and CWE Top 25 helps in creating targeted protection strategies for specific vulnerabilities like cross-site scripting.
Automating dependency checks for known vulnerabilities is essential because third-party libraries often constitute the majority of an application's code.
Using a maturity model like OWASP SAM helps shift security left by incorporating activities like threat modeling early in the design phase.
Cultivate a culture of continuous learning by using resources like OWASP Juice Shop and focusing on understanding the entire technology stack.
tree-IT GmbH
Bad Neustadt an der Saale, Germany
27:32Jasmin Azemović
58:19Michael Koppmann
29:47Thomas Chauchefoin & Paul Gerste
48:02Tanya Janca
1:41:05Mathias Tausig
51:41Panel Discussion
33:29Sebastian Leuer
26:59Jakub Andrzejewski
Jobs that call for the skills explored in this talk.
NTT Data Deutschland SE
Erfurt, Germany
HubSpot, Inc.
NTT DATA Österreich GmbH
Concepts Inc.
Washington, United States of America
