application security - Abhay Bhargav

Better OKRs for Security through Effective Threat Modeling

If you've read any management article, book or interview recently, its unlikely that you've not come across the term "OKR". The term (and practice) has become as entrenched with management culture, as its founding company, Intel, has with microchips. OKR is a goal-setting methodology

application security Featured

TL;DR on AWS Lambda Security Model

AWS recently released a whitepaper on the Security Overview of Lambda. This document [https://d1.awsstatic.com/whitepapers/Overview-AWS-Lambda-Security.pdf] is meant to be an in-depth look at Lambda Security. Its definitely a worthwhile read. However, I have tried to simplify and distill some of the most important security points

application security Featured

Stale-State Serverless Security Flaws

I'd like to introduce a possibly new class of serverless security flaws with a story. For our training business at we45, we orchestrate servers. A lot of servers. These servers are used by our many students to practice and learn concepts around Application Security, Cloud Security, Kubernetes Security,

application security Featured

Building a Static Analysis Security Bot with Gitlab

I am a big believer in Feedback loops. For me, DevSecOps is all about building better feedback loops. If I can get Dev or Ops folks to get quick security feedback on something they have written, with few/no false positives, in a workflow that they are used to, I

application security

A List of Secure Defaults

I do a lot of work at the intersection of Continuous Application Security a.k.a DevSecOps, and Threat Modeling. I see that companies have started to take both these disciplines very seriously, especially today. This is not surprising. When you have rapid application delivery processes, the need to pre-empt

threat modeling Featured

Mozilla's Rapid Risk Assessment (RRA) - Interview

I have always been passionate about Threat Modeling. Especially at efforts at: * scaling it * speeding it up * doing it collaboratively without having your Product Engineering Teams hating you * Codifying it, or.. * Integrating it with DevOps On the other hand, I have always found Mozilla to be a fascinating organization. They

agile

Think "Feedback" over "Pipelines" for DevSecOps Success

For a while now, the term DevSecOps has become synonymous with Pipelines. That is natural. DevOps, for the longest time has been associated with pipelines. I am sure, that if you've read anything around DevOps or DevSecOps, you'd have heard of the term "CI/CD&

application security

DAST Security Automation with a Markdown file

I love automation and DevSecOps. Automation is a true force multiplier for already constrained Application Security teams. In my trainings on DevSecOps, one common problem that a lot of students come to me with is "How do I automate DAST?" Admittedly, DAST is hard. DAST products usually have

application security Featured

AppSec Predictions for 2020

> > A Customary Blogpost I am going to NOT encompass "InfoSec Predictions" in this because "InfoSec" is a HUGE area and I am not nearly qualified enough to be making predictions without coming off like a jackass. That said, with AppSec, I have had the

application security

Secrets of Secrets

Secrets Management is important. Now, more than ever. Yet, I see very little attention being paid to it by Developers, DevOps teams and surprisingly, even security teams. Secrets are not only critical in protecting access to third-party APIs and components like Databases and so on, but are equally important when

application security

On Key-Stretching, Denial-of-Service and Future-Proofing

I had a really interesting conversation with a participant at my recent training at OWASP Melbourne’s always amazing event, AppSecDay Melbourne. We ran 3 Trainings at the event including our AppSec Essentials Training, DevSecOps MasterClass and our Containers and Kubernetes Security Training. In the AppSec class, I spoke about

application security

Myth-busting Developer Security Training in 2019

Myths for Developer Security Training that I have learned through personal experience over a long span of training developers on security (2012-2019 and counting) * Developers don't care about security. Untrue. Security doesn't contextualize security issues, attacks and consequences. Context is king. * "We need OWASP Top

application security

Holy s**t! We're really behind!

Have been doing a lot of work with, the Cloud, Kubernetes, Serverless and Containers over the last 2 years, and I realize that we have very little by way of effective security tooling for these technologies (especially at their depth). For me, security tools also need to be very developer

threat modeling

Thoughts on Using and Scaling Threat Modeling

Some of my pet peeves with Threat Modeling, as its currently done by a lot of orgs out there: 1. Threat Models are generated as tomes, rarely used by the people who need to be using it (architects, engineering teams, business owners, even security people) 2. Consequently, Threat Modeling does

application security

3 Essential AppSec Skills for 2020 and beyond

Have been thinking about this one for a while now, and I thought I'll pen it down in long form. For me, the 3 Essential skills in AppSec, for 2020 and beyond are: Threat Modeling More organizations are looking to "shift left", especially by way of

application security Featured

Disassembling CVE and CWE for No Fun and No Profit

There's a good chance that you or your colleague(s) will be shuffling through the massive vendor presentation areas at RSA next week. Chances are that, as you make your way through the booths with shiny screens with Dashboards and fancy-looking charts, you'll see one or

graphql Featured

The Hard Way: Security Learnings from Real-world GraphQL

This article comes (relatively) close on the heels of my talk at AppSec California. The talk was: > "An Attacker's Perspective of Serverless and GraphQL Applications" The slides for that talk are available here [https://github.com/we45/we45-Public-Presentations/blob/master/2019/AbhayBhargav_AppSecCali_SLS%26GQL.

op-ed Featured

Thoughts on Developer Security Training

I have had the good fortune to have trained thousands of developers on Application Security. Private organizations, conferences and even some non-profit groups have engaged us (we45) and my team to do this. Needless to say, this has been an extremely rewarding experience. I have had several clients say that