AppSec California 2020

Building security in has failed. After decades of attempts to improve software security, vulnerability rates are still staggering, attacks are increasing in volume and severity, development speed is increasing, and we have perennial talent shortages.  In essence, despite brilliant and well-intentioned efforts, we have been unable to push security into software through software development. Security keeps trying to constrain and correct software development with requirements, architecture, training, scanning. We spend enormous time and effort, yet we’re generating roughly zero assurance.
 
Let’s start with the end in mind. We need security code (tests, defenses, libraries) in our applications, but we can’t get it through development. Maybe there’s another way. In this talk, we’ll explore the use of software instrumentation to achieve this.  Software instrumentation is a surgically accurate way to add capabilities to applications without changing code, recompiling, or redeploying. Instrumentation is safe and proven – it’s been used at massive scale for over a decade and is part of most critical production applications – but security has only just begun to take advantage of this powerful technology.
 
Come learn the amazing things you can already achieve with security instrumentation. We’ll show how SAST, DAST, IAST, WAF, RASP, and SCA are all merging together into a unified security assessment and protection instrumentation platform that’s ideal for DevSecOps and modern software. We’ll also take a look into the future of software security. We’re only scratching the surface of what can be achieved with security instrumentation.