SlideShare a Scribd company logo
Meet the
panel
Executive Partner, Independent Security Evaluators
Infosec Skills Author
Jeff Peters
Director of Content Marketing
Infosec
Ted Harrington
Additional training resources
More from Ted Harrington
⮚ How to secure your software faster and better (ebook)
⮚ Ted’s Infosec Resources articles
⮚ How to Do Application Security Right courses
(need to create a free Infosec Skills account)
Other free resources from Infosec
⮚ Infosec Skills Monthly Challenge
⮚ Infosec YouTube channel
⮚ Infosec Accelerate Scholarship
Agenda: 10 mistakes organizations make
Challenges: Skills shortage
“Your best option is to
take a two-pronged
approach: build your
own expertise in-house,
and also hire an external
security team.”
Organizational security
External
team
In-house
experts
Testing: What methodology?
Black box is a testing
methodology that limits
information
White box is a testing
methodology that
maximizes information
vs.
Testing: What type?
“Asking for penetration
testing, being sold
vulnerability scanning,
but likely need
vulnerability
assessments.”
Scanning
Penetration
testing
Vulnerability
assessments
Find and remediate issues
Source: Hackable
“Advanced tactics is
where the magic
happens. When you
go beyond the basics,
that’s where the
critical-type issues are
found.”
Let’s talk money!
“No rational person
wants anything to be 25
times harder or 10.1
percent more expensive
than it needs to be. Yet,
companies do this all the
time when they choose
to bolt on security.”
Source: Hackable
Questions?
15 scholarships. 5 categories. $225,000+ value.
Learn cybersecurity with Infosec Skills
Infosec Skills subscription:
➢ 190+ role-based learning paths (e.g., Ethical Hacking,
Digital Forensics, Advanced Intrusion Detection)
➢ 100s of hands-on labs in cloud-hosted cyber ranges
➢ Custom certification practice exams and skill
assessments aligned to key cybersecurity roles
Infosec Skills live boot camp:
➢ Live, instructor-led training (in-person or live online)
➢ Free annual Infosec Skills subscription
➢ 1-year extended access to all boot camp video replays
and materials
➢ Exam voucher and Exam Pass Guarantee
infosecinstitute.com/skills
About us
Infosec believes knowledge is power when fighting
cybercrime. We help IT and security professionals advance
their careers with skills development and certifications
while empowering all employees with security awareness
and privacy training to stay cyber-safe at work and home.
www.infosecinstitute.com

More Related Content

Similar to How to do application security right

Fissea09 mgupta-day3-panel process-program-build-effective-training
Fissea09 mgupta-day3-panel process-program-build-effective-trainingFissea09 mgupta-day3-panel process-program-build-effective-training
Fissea09 mgupta-day3-panel process-program-build-effective-training
Swati Gupta
 
Slide Deck – Class Session 1 – FRSecure CISSP Mentor Program
Slide Deck – Class Session 1 – FRSecure CISSP Mentor ProgramSlide Deck – Class Session 1 – FRSecure CISSP Mentor Program
Slide Deck – Class Session 1 – FRSecure CISSP Mentor Program
FRSecure
 
Slide Deck - CISSP Mentor Program Class Session 1
Slide Deck - CISSP Mentor Program Class Session 1Slide Deck - CISSP Mentor Program Class Session 1
Slide Deck - CISSP Mentor Program Class Session 1
FRSecure
 
KnowBe4-Presentation-Overview.pdf
KnowBe4-Presentation-Overview.pdfKnowBe4-Presentation-Overview.pdf
KnowBe4-Presentation-Overview.pdf
ahmad661583
 
Information Security Analyst- Infosec train
Information Security Analyst- Infosec trainInformation Security Analyst- Infosec train
Information Security Analyst- Infosec train
InfosecTrain
 
How to build a cyber threat intelligence program
How to build a cyber threat intelligence programHow to build a cyber threat intelligence program
How to build a cyber threat intelligence program
Mark Arena
 
Countering the Cyber Threat
Countering the Cyber ThreatCountering the Cyber Threat
Countering the Cyber Threat
Ollie Whitehouse
 
How Cyber Security Courses Opens Up Amazing Career Opportunities?
How Cyber Security Courses Opens Up Amazing Career Opportunities?How Cyber Security Courses Opens Up Amazing Career Opportunities?
How Cyber Security Courses Opens Up Amazing Career Opportunities?
Robert Smith
 
Ceh vs Cissp difficulty, Salary, Job!
Ceh vs Cissp difficulty, Salary, Job!Ceh vs Cissp difficulty, Salary, Job!
Ceh vs Cissp difficulty, Salary, Job!
Mercury Solutions Limited
 
CEH Vs CISSP: Which one is better?
CEH Vs CISSP: Which one is better?CEH Vs CISSP: Which one is better?
CEH Vs CISSP: Which one is better?
Mercury Solutions Limited
 
7 Ultimate Benefits Of Ethical Hacking Course To Boost Your IT Career.pptx
7 Ultimate Benefits Of Ethical Hacking Course To Boost Your IT Career.pptx7 Ultimate Benefits Of Ethical Hacking Course To Boost Your IT Career.pptx
7 Ultimate Benefits Of Ethical Hacking Course To Boost Your IT Career.pptx
CCNMumbai
 
Girl Geek X Indeed Talks (January 18, 2018)
Girl Geek X Indeed Talks (January 18, 2018)Girl Geek X Indeed Talks (January 18, 2018)
Girl Geek X Indeed Talks (January 18, 2018)
Angie Chang
 
Vulnerability Analyst interview Questions.pdf
Vulnerability Analyst interview Questions.pdfVulnerability Analyst interview Questions.pdf
Vulnerability Analyst interview Questions.pdf
infosec train
 
Cybersecurity: An FBI perspective: how cyber criminals exploit the goodness o...
Cybersecurity: An FBI perspective: how cyber criminals exploit the goodness o...Cybersecurity: An FBI perspective: how cyber criminals exploit the goodness o...
Cybersecurity: An FBI perspective: how cyber criminals exploit the goodness o...
Ruth Edmonds
 
Ethnosit.net
Ethnosit.netEthnosit.net
Ethnosit.netethnos
 
Banning Whining, Avoiding Cyber Wolves, and Creating Warrior
Banning Whining, Avoiding Cyber Wolves, and Creating WarriorBanning Whining, Avoiding Cyber Wolves, and Creating Warrior
Banning Whining, Avoiding Cyber Wolves, and Creating Warrior
Sandra (Sandy) Dunn
 
10. penetration-testing-training-for-beginners-cyber51
10. penetration-testing-training-for-beginners-cyber5110. penetration-testing-training-for-beginners-cyber51
10. penetration-testing-training-for-beginners-cyber51Doree Garcia, CCNA, OSWP
 
Assessing Your security
Assessing Your securityAssessing Your security
Security Training: Making your weakest link the strongest - CircleCityCon 2017
Security Training: Making your weakest link the strongest - CircleCityCon 2017Security Training: Making your weakest link the strongest - CircleCityCon 2017
Security Training: Making your weakest link the strongest - CircleCityCon 2017
Aaron Hnatiw
 
How To Become an Ethical Hacker?
How To Become an Ethical Hacker?How To Become an Ethical Hacker?
How To Become an Ethical Hacker?
Srashti Jain
 

Similar to How to do application security right (20)

Fissea09 mgupta-day3-panel process-program-build-effective-training
Fissea09 mgupta-day3-panel process-program-build-effective-trainingFissea09 mgupta-day3-panel process-program-build-effective-training
Fissea09 mgupta-day3-panel process-program-build-effective-training
 
Slide Deck – Class Session 1 – FRSecure CISSP Mentor Program
Slide Deck – Class Session 1 – FRSecure CISSP Mentor ProgramSlide Deck – Class Session 1 – FRSecure CISSP Mentor Program
Slide Deck – Class Session 1 – FRSecure CISSP Mentor Program
 
Slide Deck - CISSP Mentor Program Class Session 1
Slide Deck - CISSP Mentor Program Class Session 1Slide Deck - CISSP Mentor Program Class Session 1
Slide Deck - CISSP Mentor Program Class Session 1
 
KnowBe4-Presentation-Overview.pdf
KnowBe4-Presentation-Overview.pdfKnowBe4-Presentation-Overview.pdf
KnowBe4-Presentation-Overview.pdf
 
Information Security Analyst- Infosec train
Information Security Analyst- Infosec trainInformation Security Analyst- Infosec train
Information Security Analyst- Infosec train
 
How to build a cyber threat intelligence program
How to build a cyber threat intelligence programHow to build a cyber threat intelligence program
How to build a cyber threat intelligence program
 
Countering the Cyber Threat
Countering the Cyber ThreatCountering the Cyber Threat
Countering the Cyber Threat
 
How Cyber Security Courses Opens Up Amazing Career Opportunities?
How Cyber Security Courses Opens Up Amazing Career Opportunities?How Cyber Security Courses Opens Up Amazing Career Opportunities?
How Cyber Security Courses Opens Up Amazing Career Opportunities?
 
Ceh vs Cissp difficulty, Salary, Job!
Ceh vs Cissp difficulty, Salary, Job!Ceh vs Cissp difficulty, Salary, Job!
Ceh vs Cissp difficulty, Salary, Job!
 
CEH Vs CISSP: Which one is better?
CEH Vs CISSP: Which one is better?CEH Vs CISSP: Which one is better?
CEH Vs CISSP: Which one is better?
 
7 Ultimate Benefits Of Ethical Hacking Course To Boost Your IT Career.pptx
7 Ultimate Benefits Of Ethical Hacking Course To Boost Your IT Career.pptx7 Ultimate Benefits Of Ethical Hacking Course To Boost Your IT Career.pptx
7 Ultimate Benefits Of Ethical Hacking Course To Boost Your IT Career.pptx
 
Girl Geek X Indeed Talks (January 18, 2018)
Girl Geek X Indeed Talks (January 18, 2018)Girl Geek X Indeed Talks (January 18, 2018)
Girl Geek X Indeed Talks (January 18, 2018)
 
Vulnerability Analyst interview Questions.pdf
Vulnerability Analyst interview Questions.pdfVulnerability Analyst interview Questions.pdf
Vulnerability Analyst interview Questions.pdf
 
Cybersecurity: An FBI perspective: how cyber criminals exploit the goodness o...
Cybersecurity: An FBI perspective: how cyber criminals exploit the goodness o...Cybersecurity: An FBI perspective: how cyber criminals exploit the goodness o...
Cybersecurity: An FBI perspective: how cyber criminals exploit the goodness o...
 
Ethnosit.net
Ethnosit.netEthnosit.net
Ethnosit.net
 
Banning Whining, Avoiding Cyber Wolves, and Creating Warrior
Banning Whining, Avoiding Cyber Wolves, and Creating WarriorBanning Whining, Avoiding Cyber Wolves, and Creating Warrior
Banning Whining, Avoiding Cyber Wolves, and Creating Warrior
 
10. penetration-testing-training-for-beginners-cyber51
10. penetration-testing-training-for-beginners-cyber5110. penetration-testing-training-for-beginners-cyber51
10. penetration-testing-training-for-beginners-cyber51
 
Assessing Your security
Assessing Your securityAssessing Your security
Assessing Your security
 
Security Training: Making your weakest link the strongest - CircleCityCon 2017
Security Training: Making your weakest link the strongest - CircleCityCon 2017Security Training: Making your weakest link the strongest - CircleCityCon 2017
Security Training: Making your weakest link the strongest - CircleCityCon 2017
 
How To Become an Ethical Hacker?
How To Become an Ethical Hacker?How To Become an Ethical Hacker?
How To Become an Ethical Hacker?
 

More from Infosec

AWS Certified DevOps Engineer: What it is and how to get certified
AWS Certified DevOps Engineer: What it is and how to get certifiedAWS Certified DevOps Engineer: What it is and how to get certified
AWS Certified DevOps Engineer: What it is and how to get certified
Infosec
 
AWS Cloud Operations Administrator: What it is and how to get certified
AWS Cloud Operations Administrator: What it is and how to get certifiedAWS Cloud Operations Administrator: What it is and how to get certified
AWS Cloud Operations Administrator: What it is and how to get certified
Infosec
 
AWS Certified Security - Specialty: What it is and how to get certified
AWS Certified Security - Specialty: What it is and how to get certifiedAWS Certified Security - Specialty: What it is and how to get certified
AWS Certified Security - Specialty: What it is and how to get certified
Infosec
 
AWS Certified Solutions Architect Webinar.pptx
AWS Certified Solutions Architect Webinar.pptxAWS Certified Solutions Architect Webinar.pptx
AWS Certified Solutions Architect Webinar.pptx
Infosec
 
Infosec and AWS - A new way to train for your AWS certification (1).pptx
Infosec and AWS - A new way to train for your AWS certification (1).pptxInfosec and AWS - A new way to train for your AWS certification (1).pptx
Infosec and AWS - A new way to train for your AWS certification (1).pptx
Infosec
 
How AI and ChatGPT are changing cybersecurity forever.pptx
How AI and ChatGPT are changing cybersecurity forever.pptxHow AI and ChatGPT are changing cybersecurity forever.pptx
How AI and ChatGPT are changing cybersecurity forever.pptx
Infosec
 
2023.06 - CompTIA Security+ Everything you need to know about the new exam .pptx
2023.06 - CompTIA Security+ Everything you need to know about the new exam .pptx2023.06 - CompTIA Security+ Everything you need to know about the new exam .pptx
2023.06 - CompTIA Security+ Everything you need to know about the new exam .pptx
Infosec
 
NCSAM 2023 Webinar.pptx
NCSAM 2023 Webinar.pptxNCSAM 2023 Webinar.pptx
NCSAM 2023 Webinar.pptx
Infosec
 
CompTIA CySA+ certification (CS0-003) changes: Everything you need to know
CompTIA CySA+ certification (CS0-003) changes: Everything you need to knowCompTIA CySA+ certification (CS0-003) changes: Everything you need to know
CompTIA CySA+ certification (CS0-003) changes: Everything you need to know
Infosec
 
Skills training value: How to differentiate your staff and your organization ...
Skills training value: How to differentiate your staff and your organization ...Skills training value: How to differentiate your staff and your organization ...
Skills training value: How to differentiate your staff and your organization ...
Infosec
 
Learning ≠ Education: How people really learn and what it means for security ...
Learning ≠ Education: How people really learn and what it means for security ...Learning ≠ Education: How people really learn and what it means for security ...
Learning ≠ Education: How people really learn and what it means for security ...
Infosec
 
Security awareness training - 4 topics that matter most
Security awareness training - 4 topics that matter mostSecurity awareness training - 4 topics that matter most
Security awareness training - 4 topics that matter most
Infosec
 
Join the hunt: Threat hunting for proactive cyber defense.pptx
Join the hunt: Threat hunting for proactive cyber defense.pptxJoin the hunt: Threat hunting for proactive cyber defense.pptx
Join the hunt: Threat hunting for proactive cyber defense.pptx
Infosec
 
Threat hunting foundations: People, process and technology.pptx
Threat hunting foundations: People, process and technology.pptxThreat hunting foundations: People, process and technology.pptx
Threat hunting foundations: People, process and technology.pptx
Infosec
 
Get started in cybersecurity in 2022
Get started in cybersecurity in 2022Get started in cybersecurity in 2022
Get started in cybersecurity in 2022
Infosec
 
CompTIA PenTest+: Everything you need to know about the exam
CompTIA PenTest+: Everything you need to know about the examCompTIA PenTest+: Everything you need to know about the exam
CompTIA PenTest+: Everything you need to know about the exam
Infosec
 
CompTIA CASP+ | Everything you need to know about the new exam
CompTIA CASP+ | Everything you need to know about the new examCompTIA CASP+ | Everything you need to know about the new exam
CompTIA CASP+ | Everything you need to know about the new exam
Infosec
 
CompTIA network+ | Everything you need to know about the new exam
CompTIA network+ | Everything you need to know about the new examCompTIA network+ | Everything you need to know about the new exam
CompTIA network+ | Everything you need to know about the new exam
Infosec
 
Isaca career paths - the highest paying certifications in the industry
Isaca career paths - the highest paying certifications in the industryIsaca career paths - the highest paying certifications in the industry
Isaca career paths - the highest paying certifications in the industry
Infosec
 
CMMC case study: Inside a CMMC assessment
CMMC case study: Inside a CMMC assessmentCMMC case study: Inside a CMMC assessment
CMMC case study: Inside a CMMC assessment
Infosec
 

More from Infosec (20)

AWS Certified DevOps Engineer: What it is and how to get certified
AWS Certified DevOps Engineer: What it is and how to get certifiedAWS Certified DevOps Engineer: What it is and how to get certified
AWS Certified DevOps Engineer: What it is and how to get certified
 
AWS Cloud Operations Administrator: What it is and how to get certified
AWS Cloud Operations Administrator: What it is and how to get certifiedAWS Cloud Operations Administrator: What it is and how to get certified
AWS Cloud Operations Administrator: What it is and how to get certified
 
AWS Certified Security - Specialty: What it is and how to get certified
AWS Certified Security - Specialty: What it is and how to get certifiedAWS Certified Security - Specialty: What it is and how to get certified
AWS Certified Security - Specialty: What it is and how to get certified
 
AWS Certified Solutions Architect Webinar.pptx
AWS Certified Solutions Architect Webinar.pptxAWS Certified Solutions Architect Webinar.pptx
AWS Certified Solutions Architect Webinar.pptx
 
Infosec and AWS - A new way to train for your AWS certification (1).pptx
Infosec and AWS - A new way to train for your AWS certification (1).pptxInfosec and AWS - A new way to train for your AWS certification (1).pptx
Infosec and AWS - A new way to train for your AWS certification (1).pptx
 
How AI and ChatGPT are changing cybersecurity forever.pptx
How AI and ChatGPT are changing cybersecurity forever.pptxHow AI and ChatGPT are changing cybersecurity forever.pptx
How AI and ChatGPT are changing cybersecurity forever.pptx
 
2023.06 - CompTIA Security+ Everything you need to know about the new exam .pptx
2023.06 - CompTIA Security+ Everything you need to know about the new exam .pptx2023.06 - CompTIA Security+ Everything you need to know about the new exam .pptx
2023.06 - CompTIA Security+ Everything you need to know about the new exam .pptx
 
NCSAM 2023 Webinar.pptx
NCSAM 2023 Webinar.pptxNCSAM 2023 Webinar.pptx
NCSAM 2023 Webinar.pptx
 
CompTIA CySA+ certification (CS0-003) changes: Everything you need to know
CompTIA CySA+ certification (CS0-003) changes: Everything you need to knowCompTIA CySA+ certification (CS0-003) changes: Everything you need to know
CompTIA CySA+ certification (CS0-003) changes: Everything you need to know
 
Skills training value: How to differentiate your staff and your organization ...
Skills training value: How to differentiate your staff and your organization ...Skills training value: How to differentiate your staff and your organization ...
Skills training value: How to differentiate your staff and your organization ...
 
Learning ≠ Education: How people really learn and what it means for security ...
Learning ≠ Education: How people really learn and what it means for security ...Learning ≠ Education: How people really learn and what it means for security ...
Learning ≠ Education: How people really learn and what it means for security ...
 
Security awareness training - 4 topics that matter most
Security awareness training - 4 topics that matter mostSecurity awareness training - 4 topics that matter most
Security awareness training - 4 topics that matter most
 
Join the hunt: Threat hunting for proactive cyber defense.pptx
Join the hunt: Threat hunting for proactive cyber defense.pptxJoin the hunt: Threat hunting for proactive cyber defense.pptx
Join the hunt: Threat hunting for proactive cyber defense.pptx
 
Threat hunting foundations: People, process and technology.pptx
Threat hunting foundations: People, process and technology.pptxThreat hunting foundations: People, process and technology.pptx
Threat hunting foundations: People, process and technology.pptx
 
Get started in cybersecurity in 2022
Get started in cybersecurity in 2022Get started in cybersecurity in 2022
Get started in cybersecurity in 2022
 
CompTIA PenTest+: Everything you need to know about the exam
CompTIA PenTest+: Everything you need to know about the examCompTIA PenTest+: Everything you need to know about the exam
CompTIA PenTest+: Everything you need to know about the exam
 
CompTIA CASP+ | Everything you need to know about the new exam
CompTIA CASP+ | Everything you need to know about the new examCompTIA CASP+ | Everything you need to know about the new exam
CompTIA CASP+ | Everything you need to know about the new exam
 
CompTIA network+ | Everything you need to know about the new exam
CompTIA network+ | Everything you need to know about the new examCompTIA network+ | Everything you need to know about the new exam
CompTIA network+ | Everything you need to know about the new exam
 
Isaca career paths - the highest paying certifications in the industry
Isaca career paths - the highest paying certifications in the industryIsaca career paths - the highest paying certifications in the industry
Isaca career paths - the highest paying certifications in the industry
 
CMMC case study: Inside a CMMC assessment
CMMC case study: Inside a CMMC assessmentCMMC case study: Inside a CMMC assessment
CMMC case study: Inside a CMMC assessment
 

Recently uploaded

DevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA ConnectDevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA Connect
Kari Kakkonen
 
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdfFIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance
 
Essentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with ParametersEssentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with Parameters
Safe Software
 
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered QualitySoftware Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Inflectra
 
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
Product School
 
GraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge GraphGraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge Graph
Guy Korland
 
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
UiPathCommunity
 
Epistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI supportEpistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI support
Alan Dix
 
Leading Change strategies and insights for effective change management pdf 1.pdf
Leading Change strategies and insights for effective change management pdf 1.pdfLeading Change strategies and insights for effective change management pdf 1.pdf
Leading Change strategies and insights for effective change management pdf 1.pdf
OnBoard
 
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMsTo Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
Paul Groth
 
When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...
Elena Simperl
 
How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...
Product School
 
Monitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR EventsMonitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR Events
Ana-Maria Mihalceanu
 
Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........
Alison B. Lowndes
 
The Future of Platform Engineering
The Future of Platform EngineeringThe Future of Platform Engineering
The Future of Platform Engineering
Jemma Hussein Allen
 
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
James Anderson
 
Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...
Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...
Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...
Thierry Lestable
 
Designing Great Products: The Power of Design and Leadership by Chief Designe...
Designing Great Products: The Power of Design and Leadership by Chief Designe...Designing Great Products: The Power of Design and Leadership by Chief Designe...
Designing Great Products: The Power of Design and Leadership by Chief Designe...
Product School
 
The Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and SalesThe Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and Sales
Laura Byrne
 
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdfFIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance
 

Recently uploaded (20)

DevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA ConnectDevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA Connect
 
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdfFIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
 
Essentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with ParametersEssentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with Parameters
 
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered QualitySoftware Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
 
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
 
GraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge GraphGraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge Graph
 
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
 
Epistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI supportEpistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI support
 
Leading Change strategies and insights for effective change management pdf 1.pdf
Leading Change strategies and insights for effective change management pdf 1.pdfLeading Change strategies and insights for effective change management pdf 1.pdf
Leading Change strategies and insights for effective change management pdf 1.pdf
 
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMsTo Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
 
When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...
 
How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...
 
Monitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR EventsMonitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR Events
 
Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........
 
The Future of Platform Engineering
The Future of Platform EngineeringThe Future of Platform Engineering
The Future of Platform Engineering
 
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
 
Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...
Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...
Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...
 
Designing Great Products: The Power of Design and Leadership by Chief Designe...
Designing Great Products: The Power of Design and Leadership by Chief Designe...Designing Great Products: The Power of Design and Leadership by Chief Designe...
Designing Great Products: The Power of Design and Leadership by Chief Designe...
 
The Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and SalesThe Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and Sales
 
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdfFIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
 

How to do application security right

  • 1.
  • 2. Meet the panel Executive Partner, Independent Security Evaluators Infosec Skills Author Jeff Peters Director of Content Marketing Infosec Ted Harrington
  • 3. Additional training resources More from Ted Harrington ⮚ How to secure your software faster and better (ebook) ⮚ Ted’s Infosec Resources articles ⮚ How to Do Application Security Right courses (need to create a free Infosec Skills account) Other free resources from Infosec ⮚ Infosec Skills Monthly Challenge ⮚ Infosec YouTube channel ⮚ Infosec Accelerate Scholarship
  • 4. Agenda: 10 mistakes organizations make
  • 5. Challenges: Skills shortage “Your best option is to take a two-pronged approach: build your own expertise in-house, and also hire an external security team.” Organizational security External team In-house experts
  • 6. Testing: What methodology? Black box is a testing methodology that limits information White box is a testing methodology that maximizes information vs.
  • 7. Testing: What type? “Asking for penetration testing, being sold vulnerability scanning, but likely need vulnerability assessments.” Scanning Penetration testing Vulnerability assessments
  • 8. Find and remediate issues Source: Hackable “Advanced tactics is where the magic happens. When you go beyond the basics, that’s where the critical-type issues are found.”
  • 9. Let’s talk money! “No rational person wants anything to be 25 times harder or 10.1 percent more expensive than it needs to be. Yet, companies do this all the time when they choose to bolt on security.” Source: Hackable
  • 11. 15 scholarships. 5 categories. $225,000+ value.
  • 12. Learn cybersecurity with Infosec Skills Infosec Skills subscription: ➢ 190+ role-based learning paths (e.g., Ethical Hacking, Digital Forensics, Advanced Intrusion Detection) ➢ 100s of hands-on labs in cloud-hosted cyber ranges ➢ Custom certification practice exams and skill assessments aligned to key cybersecurity roles Infosec Skills live boot camp: ➢ Live, instructor-led training (in-person or live online) ➢ Free annual Infosec Skills subscription ➢ 1-year extended access to all boot camp video replays and materials ➢ Exam voucher and Exam Pass Guarantee infosecinstitute.com/skills
  • 13. About us Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. www.infosecinstitute.com