WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2023 • Sep 27, 2023

Security Pitfalls for Software Engineers

Jasmin Azemović

Speed without security guarantees catastrophic breaches. Discover why missing input validation remains your application's biggest vulnerability. Learn how to bake DevSecOps directly into your daily workflow.

Pause
Mute Enter Fullscreen
#1 about 5 min

Financial and operational consequences of security breaches

Massive data breaches incur millions in costs and expose critical customer records to malicious external actors.

#2 about 3 min

Establishing foundational security practices and least privilege

Eliminating unnecessary administrative access vastly reduces the system attack surface during routine testing workflows.

#3 about 4 min

Writing secure code and utilizing threat modeling methodologies

Validating active user inputs and applying the STRIDE security framework proactively prevents deep operational system vulnerabilities.

#4 about 2 min

Mitigating risks from supply chain attacks and vulnerable libraries

Exploited open source dependencies like Log4j highlight the absolute necessity for aggressive software supply chain oversight.

#5 about 3 min

Integrating DevSecOps within the software development lifecycle

Embedding automated guardian tools into deployment pipelines aggressively catches compromised credentials and dependencies before production stages.

#6 about 2 min

Securing exposed application programming interfaces against unauthenticated access

Enforcing strict authentication and transport layer encryption prevents malicious external actors from intercepting sensitive API endpoints.

#7 about 4 min

Protecting sensitive endpoint data via active database layer encryption

Encrypting highly specific columns and managing temporal key states protects entire database records during catastrophic system leaks.

#8 about 2 min

Maintaining automated historical audit logs with temporal database features

Storing comprehensive historical state changes inside temporal databases inherently provides tamper-proof logs for deep forensic analysis.

#9 about 3 min

Structuring critical internal and external penetration testing procedures

Hiring unassociated ethical hackers to manually perform varied penetration box tests strictly ensures completely unbiased vulnerability discovery.

#10 about 3 min

Separating personal freelance workloads from secure corporate hardware environments

Managing personal software projects solely on private hardware fully insulates corporate networks from severe legal and security liabilities.

Matching moments

5:30 min

Identifying non-coding software vulnerabilities and organizational risks

Tino Sokic · World Congress 2023

2:49 min

Integrating fundamental security evaluations into agile development sprints

Bozidar Spirovski Bozidar Spirovski +1 · Coffee With Developers

2:05 min

Making security a foundational feature in software development

Eileen Uchitelle Eileen Uchitelle +1 · Coffee With Developers

26:47 min

Exploring pathways to application security careers and research workflows

Vandana Verma Sehgal · LIVE

3:22 min

Transitioning from software engineering to security roles

Anna Oliveira · Coffee With Developers

7:16 min

Addressing developer adoption and future software security risks

Anna Fritsch-Weninger · LIVE

More from World Congress 2023

The year 3000, a brief history of Web Development thumbnail
25:30
over 2 years ago

The year 3000, a brief history of Web Development

Lorenzo Pieri

Demografie nutzen um jedem Bewerber das passende Angebot zu machen! thumbnail
8:52
almost 3 years ago

Demografie nutzen um jedem Bewerber das passende Angebot zu machen!

Nathalie Gierth

Guided Memory Management: Rust's Ownership Model thumbnail
0:18
almost 3 years ago

Guided Memory Management: Rust's Ownership Model

Stefan Baumgartner

Passwordless future: WebAuthn and Passkeys in practice thumbnail
32:32
almost 3 years ago

Passwordless future: WebAuthn and Passkeys in practice

Clemens Hübner

External Secrets Operator: the secrets management toolbox for self-sufficient teams thumbnail
30:07
almost 3 years ago

External Secrets Operator: the secrets management toolbox for self-sufficient teams

Moritz Johner

Building Reliable Serverless Applications with AWS CDK and Testing thumbnail
25:18
almost 3 years ago

Building Reliable Serverless Applications with AWS CDK and Testing

Raphael Manke

Upcoming sessions on this topic

Open session

World Congress 2026 North America

September 25, 2026 · 15:00–17:00

Stage 12

Secure development from pull request to production with GitHub

Sam Jarvinen

Senior Solutions Engineer, GitHub

Sam Jarvinen
Open session

World Congress 2026 North America

September 24, 2026 · 16:00–18:00

Stage 11

Practical Threat Modeling for Software Developers

Mudassir Syed

Lead Security Software Engineer

Mudassir Syed
Open session

World Congress 2026 North America

September 25, 2026 · 11:00–11:30

Stage 6

Secure-by-Inclusion: Preventing Accessibility Barriers from Becoming Security Vulnerabilities

Radostina (Ina) Tsvetkova

Norwegian Directorate of Labour and Welfare (NAV), Senior Advisor in Digital Accessibility and Inclusive Design

Radostina (Ina) Tsvetkova
Open session

World Congress 2026 North America

September 23, 2026 · 15:45–17:45

Stage 10

Securing the Agentic Stack: Docker Hardened Images and Supply Chain Security

Ajeet Raina

Developer Advocate at Docker

Ajeet Raina
Open session

World Congress 2026 North America

September 23, 2026 · 14:00–14:30

Stage 1

Supply Chain Security When Agents Write the Code

Ajeet Raina

Developer Advocate at Docker

Ajeet Raina
Open session

World Congress 2026 North America

September 25, 2026 · 09:00–09:30

Stage 4

Don’t kill my Vibes - Simple Steps to Stay Secure when Vibe Coding

Isaac Evans

Founder & CEO of Semgrep

Isaac Evans

Related videos

Software Security 101: Secure Coding Basics thumbnail
1:58:48
World Congress 2021 • about 5 years ago

Software Security 101: Secure Coding Basics

Thomas Konrad

You can’t hack what you can’t see thumbnail
29:34
LIVE • almost 6 years ago

You can’t hack what you can’t see

Reto Kaeser

Walking into the era of Supply Chain Risks thumbnail
37:36
LIVE • over 4 years ago

Walking into the era of Supply Chain Risks

Vandana Verma

Secure Code Superstars: Empowering Developers and Surpassing Security Challenges Together thumbnail
23:34
World Congress 2022 • about 4 years ago

Secure Code Superstars: Empowering Developers and Surpassing Security Challenges Together

Stefania Chaplin

Stranger Danger: Your Java Attack Surface Just Got Bigger thumbnail
1:58:59
LIVE • over 4 years ago

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

Securing Your Web Application Pipeline From Intruders thumbnail
44:30
LIVE • almost 6 years ago

Securing Your Web Application Pipeline From Intruders

Milecia Mcgregor

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.