Jasmin Azemović

Security Pitfalls for Software Engineers

Thinking about security at the end of your development cycle is already too late. Here’s how to fix it.

Security Pitfalls for Software Engineers
#1about 4 minutes

The high cost and consequences of security breaches

Major companies like Uber and Microsoft have suffered massive data breaches, costing millions and highlighting the severe financial and reputational risks of poor security.

#2about 6 minutes

Foundational practices for writing secure software code

Writing secure code starts with fundamental practices like proper input validation, applying threat modeling methodologies like STRIDE, and adhering to the principle of least privilege.

#3about 5 minutes

Mitigating supply chain attacks with DevSecOps practices

Vulnerabilities in third-party libraries, like the SolarWinds and Log4j incidents, necessitate a DevSecOps approach to integrate security checks throughout the software development lifecycle.

#4about 2 minutes

Essential security measures for protecting public APIs

Publicly exposed APIs must be protected using strong authentication, TLS/SSL encryption for data in transit, and defenses against common attack vectors.

#5about 5 minutes

Protecting data with database encryption and temporal tables

Encrypting sensitive data at the database level protects it even if breached, while temporal tables provide a complete audit trail for forensic analysis.

#6about 2 minutes

Implementing a robust penetration testing strategy

Regular penetration testing, distinct from QA, should be a standard practice using methodologies like black-box or white-box testing and frameworks like the OWASP Top 10.

#7about 1 minute

Maintaining security by separating work and personal devices

Avoid using company-issued laptops for personal or freelance projects to prevent legal liabilities and security compromises between environments.

#8about 3 minutes

Q&A on vulnerable libraries and team security responsibility

The session concludes with answers to audience questions about tracking open-source vulnerabilities, choosing a pen test environment, and clarifying security roles within an agile team.

Related jobs
Jobs that call for the skills explored in this talk.

Software Engineer

tree-IT GmbH

tree-IT GmbH
Bad Neustadt an der Saale, Germany

€54-80K
Intermediate
Senior
Java
TypeScript
+1

Matching moments

Cybersecurity is a foundational necessity not a passing trend
05:49 MIN

Cybersecurity is a foundational necessity not a passing trend

Decoding Trends: Strategies for Success in the Evolving Digital Domain

Why developers make basic cybersecurity mistakes
02:26 MIN

Why developers make basic cybersecurity mistakes

Don't Be A Naive Developer: How To Avoid Basic Cybersecurity Mistakes

Balancing developer and stakeholder security priorities
04:25 MIN

Balancing developer and stakeholder security priorities

What The Hack is Web App Sec?

Common security failures beyond individual coding errors
03:27 MIN

Common security failures beyond individual coding errors

Maturity assessment for technicians or how I learned to love OWASP SAMM

From vulnerability researcher to automated security founder
05:31 MIN

From vulnerability researcher to automated security founder

The transformative impact of GenAI for software development and its implications for cybersecurity

Key strategies for building a secure code culture
02:23 MIN

Key strategies for building a secure code culture

Secure Code Superstars: Empowering Developers and Surpassing Security Challenges Together

Why developers must take ownership of application security
09:14 MIN

Why developers must take ownership of application security

Real-World Security for Busy Developers

Exploring the need for regulation in software development
03:35 MIN

Exploring the need for regulation in software development

Climate vs. Weather: How Do We Sustainably Make Software More Secure?

Featured Partners

Related Videos

See all videos
Software Security 101: Secure Coding Basics1:58:48

Software Security 101: Secure Coding Basics

Thomas Konrad

Cybersecurity for Software Defined Vehicles22:09

Cybersecurity for Software Defined Vehicles

Henning Harbs

You can’t hack what you can’t see29:34

You can’t hack what you can’t see

Reto Kaeser

You click, you lose: a practical look at VSCode's security29:47

You click, you lose: a practical look at VSCode's security

Thomas Chauchefoin & Paul Gerste

Building Security Champions48:02

Building Security Champions

Tanya Janca

Climate vs. Weather: How Do We Sustainably Make Software More Secure?51:41

Climate vs. Weather: How Do We Sustainably Make Software More Secure?

Panel Discussion

Unleashing the Power of Developers: Why Cybersecurity is the Missing Piece?!?27:36

Unleashing the Power of Developers: Why Cybersecurity is the Missing Piece?!?

Tino Sokic

101 Typical Security Pitfalls28:41

101 Typical Security Pitfalls

Alexander Pirker

Related Articles

View all articles
DC
Daniel Cranney
Why Attend a Developer Event?
Modern software engineering moves too fast for documentation alone. Attending a world-class event is about shifting from tactical execution to strategic leadership. Skill Diversification: Break out of your specific tech stack to see how the industry...
Why Attend a Developer Event?
CH
Chris Heilmann
Dev Digest 138 - Are you secure about this?
Hello there! This is the 2nd "out of the can" edition of 3 as I am on vacation in Greece eating lovely things on the beach. So, fewer news, but lots of great resources. Many around the topic of security. Enjoy! News and ArticlesGoogle Pixel phones t...
Dev Digest 138 - Are you secure about this?

From learning to earning

Jobs that call for the skills explored in this talk.