Can good development practices make a bad app good? In this talk, we will examine the development practices utilized in more than 132k applications. Using rigorous, data-driven analysis, we measure how dynamic and static scanning, scan cadence and frequency, and software composition analysis affect application security. We will show that good practices can make the most security-debt riddled app safer. 

RSA® Conference, the world’s leading information security conferences and expositions, concluded its 30th annual event, which took place as a fully virtual experience this week. This year’s theme was Resilience, and in honor of all that the cybersecurity industry has accomplished over the past three decades, offered a must-attend celebration of thought leadership and education.


More than 20,000 people registered to view 449 sessions including, keynotes, track sessions, interactive programs, tutorials, seminars, and many special digital-first programs that focused on best practices and innovation. The content covered many of the industry’s most pressing topics, including privacy, machine learning and artificial intelligence, analytics, anti-fraud, policy and government, and risk management and governance.

Nurture vs. Nature in AppSec: Data-Driven Measurement of DevSecOps

Conference: RSA Conference 2021

Abstract

Post a comment

Related work

Policy Implications of Faulty Cyber Risk Models and How to Fix Them

Abusing SAST tools! When scanners do more than just scanning

SirenJack: Cracking a 'Secure' Emergency Warning Siren System

Damned if you do - The risks of pointing out the emperor is buck naked

OTRazor: Static Code Analysis for Vulnerability Discovery in Industrial Automation Scripts

Achieving Security by Shifting Left in Agile