Major companies like Uber and Microsoft have suffered massive data breaches, costing millions and highlighting the severe financial and reputational risks of poor security.
Writing secure code starts with fundamental practices like proper input validation, applying threat modeling methodologies like STRIDE, and adhering to the principle of least privilege.
Vulnerabilities in third-party libraries, like the SolarWinds and Log4j incidents, necessitate a DevSecOps approach to integrate security checks throughout the software development lifecycle.
Publicly exposed APIs must be protected using strong authentication, TLS/SSL encryption for data in transit, and defenses against common attack vectors.
Encrypting sensitive data at the database level protects it even if breached, while temporal tables provide a complete audit trail for forensic analysis.
Regular penetration testing, distinct from QA, should be a standard practice using methodologies like black-box or white-box testing and frameworks like the OWASP Top 10.
Avoid using company-issued laptops for personal or freelance projects to prevent legal liabilities and security compromises between environments.
The session concludes with answers to audience questions about tracking open-source vulnerabilities, choosing a pen test environment, and clarifying security roles within an agile team.
Bitpanda
Vienna, Austria
tree-IT GmbH
Bad Neustadt an der Saale, Germany
1:58:48Thomas Konrad
22:09Henning Harbs
29:34Reto Kaeser
29:47Thomas Chauchefoin & Paul Gerste
48:02Tanya Janca
51:41Panel Discussion
27:36Tino Sokic
28:41Alexander Pirker
Jobs that call for the skills explored in this talk.
Secwisers
Cloudspace LLC
Lake Mary, United States of America
Samsara Inc.
San Francisco, United States of America
Agile Defense
Washington, United States of America
