Life Coach, Conspiracy Theorist, and Absurdist. I do AppSec in my non-spare time for money. My opinions are now your opinions, but at least you are now right!
The Wasteland
Joined March 2012
- Tweets7.4K
- Following316
- Followers570
- Likes3.2K
Pinned Tweet
So I have a mastodon account now. I haven't really been using Twittter much lately. hit me up
infosec.exchange/@raybeorn
There is one thing that he points out that I really like. Reducing the cognitive load on developers. Everyone is all about teaching developers about security. That is a good idea. But if we can give developers some security features for free even better.
An underrated aspect of AppSec and Secure Coding is not exposing the insecure functionality in the first place.
Let's say you have a XML parsing library that may be used by devs wrongly/insecurely. By disabling certain functions in the library, its not vulnerable to XML Injection anymore
Instead of constantly training them to figure out security params, having a wrapper library (custom) that automatically disables insecure functionality is way more effective.
It's:
* easier to use
* easier to enforce (in SAST, CI, SBOM, etc)
* easier to train on
* reduces cognitive load for devs in the long run
* and more secure
Keep it simple.
Apparently things get better when people and companies are accountable for their shit.
Good blog by @Jo3Ram
I've been meaning to blog a bit more. I authored this post in an attempt to consolidate my thoughts following the recent $MSFT and CVE-2024-3400 news.
We need all need to be better.
#SoftwareLiabilityReform
medium.com/@JoeChrist/where-…
ray retweeted
Join @semgrep community for a live panel on "Building a Successful Security Champions Program: What Does it Take?" with AppSec veterans Chris Romeo @edgeroute, Dustin Lehr @DustinLehr1, Devin Rudnicki, and Ray Leblanc @Raybeorn
ow.ly/WngS50QBpRN
#SecurityChampions #AppSec
ray retweeted
Join @semgrep community for a live panel on "Building a Successful Security Champions Program: What Does it Take?" with AppSec veterans Chris Romeo @edgeroute, Dustin Lehr @DustinLehr1, Devin Rudnicki, and Ray Leblanc @Raybeorn
ow.ly/WngS50QBpRN
#SecurityChampions #AppSec
ray retweeted
Join @semgrep community for a live panel on "Building a Successful Security Champions Program: What Does it Take?" with AppSec veterans Chris Romeo @edgeroute, Dustin Lehr @DustinLehr1, Devin Rudnicki, and Ray Leblanc @Raybeorn
ow.ly/WngS50QBpRN
#SecurityChampions #AppSec
ray retweeted
Join @semgrep community for a live panel on "Building a Successful Security Champions Program: What Does it Take?" with AppSec veterans Chris Romeo @edgeroute, Dustin Lehr @DustinLehr1, Devin Rudnicki, and Ray Leblanc @Raybeorn
ow.ly/WngS50QBpRN
#SecurityChampions #AppSec
ray retweeted
Join @semgrep community for a live panel on "Building a Successful Security Champions Program: What Does it Take?" with AppSec veterans Chris Romeo @edgeroute, Dustin Lehr @DustinLehr1, Devin Rudnicki, and Ray Leblanc @Raybeorn
ow.ly/WngS50QBpRN
#SecurityChampions #AppSec
ray retweeted
Join @semgrep community for a live panel on "Building a Successful Security Champions Program: What Does it Take?" with AppSec veterans Chris Romeo @edgeroute, Dustin Lehr @DustinLehr1, Devin Rudnicki, and Ray Leblanc @Raybeorn
ow.ly/WngS50QBpRN
#SecurityChampions #AppSec
AppSec interviews are like “please threat model this app that i am going to poorly explain to you” and then they are like you missed this one threat that we consider important
Why do non AppSec security people always think they can build appsec programs so easily? Like shit, why didn’t we think about putting a scanning in out pipelines
So we tried bug bounties, dev sec ops, and now threat modeling. When are we actually gonna start doing app sec and securing things?
Security tool vendors, stop failing your customers. Build something great. For appsec tools, they need to be usable and bring value to both the dev and security teams.
Also all your pricing models suck, be more flexible.
Also what is the point of having a pricing page when every customer gets a “discount”? Just put the real prices in your page