Application Security The source code perspective Authors: - PowerPoint PPT Presentation

Nov 13, 2022 •1.11k likes •1.31k views

Application Security The source code perspective Authors: Francesco Consiglio Marco Borza Implementation Challenges Iron Triangle Security as an afterthought The Secure SDLC in the Waterfall Model SDLC vs Secure SDLC Cost Reduction

Application Security The source code perspective Authors: Francesco Consiglio Marco Borza
Implementation Challenges • Iron Triangle • Security as an afterthought
The Secure SDLC in the Waterfall Model
SDLC vs Secure SDLC
Cost Reduction in the Secure SDLC TIME & COST “Cost to find/fix a defect during integration/system test is 15-90 times higher Integration & than at design/coding” System Testing Unit Testing SCAN BINARIES Code Inspection Static analysis tools find defects & design flaws “in phase” SCAN SOURCES WITH CHECKMARX PRODUCT LIFECYCLE DESIGN CODING QA PRODUCTION
Before we met Checkmarx … • Complex usability and unfamiliar interfaces (or familiar to coders only) • Inaccurate results reaching a high rate of FPs • Unaffordable solutions eventually requiring vast resources
Checkmarx SAST
• Leading Static Application Security Testing Vendor (SAST) • Ranked 2 nd Fastest Growing Security Company by • “Best Application Security Product in 2014” by Cyber Defense Magazine • Patented Technology • Strong financial backing, IWI, Ofer • Fortune 500 customers
Thank You!

Recommend

DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and

DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and

863 views • 71 slides

OWASP Top 10 OWASP Top Ten meets JSF Andreas Hartmann Application Security Komponente

Agenda Application Security OWASP Top 10 OWASP Top Ten meets JSF Andreas Hartmann Application Security Komponente Application Security Startup 04.04.2013 04.04.2013 2 OWASP Top 10 Agenda Application Security Was ist Application Security

235 views • 8 slides

Application Security as a Service: Start Your Application Security Initiative in Less than a Day

Application Security as a Service: Start Your Application Security Initiative in Less than a Day David Harper Practice Principal Fortify on Demand #MicroFocusCyberSummit Agenda The Application Security Problem Security Gate Secure DevOps

37.4k views • 30 slides

Scenegraphs and Engines Scenegraphs and Engines Scenegraphs Application Application

Scenegraphs and Engines Scenegraphs and Engines Scenegraphs Application Application Application Application Application Application Application Application Scenegraph Scenegraph Scenegraph Scenegraph Scenegraph Scenegraph Scenegraph

773 views • 18 slides

Web Application Security Attacks on the Web Attacker Web User Application Web Database Web

IN3210 Network Security Web Application Security Attacks on the Web Attacker Web User Application Web Database Web Server Application 2 The OWASP Foundation The Open Web Application Security Project (OWASP) is a 501(c)(3)

1.22k views • 60 slides

United Way of Will County Application Training Application Process Application Site

United Way of Will County Application Training Application Process Application Site Visits Review Panel Application Timeline January 13, 2017: Funding application goes live February 17, 2017: Funding application due

332 views • 14 slides

Network Security Network Security Srinidhi Varadarajan Network security Network security

Network Security Network Security Srinidhi Varadarajan Network security Network security Foundations: what is security? cryptography authentication message integrity key distribution and certification Security in practice:

648 views • 36 slides

Application Security Management (ASM) August 9, 2016 CC Kermen Agenda About Application

Application Security Management (ASM) August 9, 2016 CC Kermen Agenda About Application Security Management (ASM) Features and Benefits Performance Review Ordering Information About Application Security Management (ASM)

620 views • 7 slides

Great Lakes Chloride, Inc. Direct Liquid Application (DLA) Direct Liquid Application (DLA)

Presented by Dave Budd Great Lakes Chloride, Inc. Direct Liquid Application (DLA) Direct Liquid Application (DLA) Direct Liquid Application (DLA) Direct Liquid Application (DLA) Direct Liquid Application (DLA) Direct Liquid Application (DLA)

359 views • 21 slides

Application Accelerators: Application Accelerators: Application Accelerators: Application

Application Accelerators: Application Accelerators: Application Accelerators: Application Accelerators: Dues ex Dues ex machina machina machina ? ? Dues ex Dues ex machina CCGSC, Flat Rock, North Carolina CCGSC, Flat Rock, North

679 views • 40 slides

Transport Layer Security The TLS Protocol Transport Layer Security (TLS) Security goals:

IN3210 Network Security Transport Layer Security The TLS Protocol Transport Layer Security (TLS) Security goals: Authentication Integrity Confidentiality Transparent security protocol between TCP and application

1.01k views • 66 slides

Security, Security, Security Presentation to NSAI Consultation Meeting Chinese National Body

Chinese NB presentation: Security, Security, Security Dublin, Ireland, Feb. 22, 2006 Security, Security, Security Presentation to NSAI Consultation Meeting Chinese National Body Feb. 22, 2006 Thank you Mr. Chairman, Chinese National

240 views • 7 slides

UCP GROUP Maritime Security Services UCP GROUP ONE SOLUTION ONE PLATFORM ONE SECURITY SERVICE

UCP GROUP Maritime Security Services UCP GROUP ONE SOLUTION ONE PLATFORM ONE SECURITY SERVICE Maritime Security - Commercial Shipping Security - Cruise Liner Security - Super-Yacht Security Maritime Security Services UCP GROUP is a market

253 views • 22 slides

Xpanda security gates Security solutions Retail security gate solutions Industrial

STOREFRONT PROTECTION Xpanda security gates Security solutions Retail security gate solutions Industrial security gate solutions Institutional security gate solutions Access control security gate solutions Office building

407 views • 13 slides

A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security

A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security Introducing Spring Security View layer security Whats coming in Spring Security 3 E-mail: craig@habuma.com Blog: http://www.springloaded.info

457 views • 19 slides

OS Security Thierry Sans Security is a wide topic CSCD27 Computer and Network Security covers

OS Security Thierry Sans Security is a wide topic CSCD27 Computer and Network Security covers Cryptography Network security System security Web security (recap) Protection File systems implement a protection system Who

803 views • 30 slides

Numerical Investigation of Summer Sea Breeze Using Updated Urban Aerodynamic Parameters in Kanto

Numerical Investigation of Summer Sea Breeze Using Updated Urban Aerodynamic Parameters in Kanto Region Alvin Christopher G. Varquez, Makoto Nakayoshi, Manabu Kanda 1 Update on Roughness Parameters Thanks to Large Eddy Simulations, a

440 views • 18 slides

Future-Ready Workforce Vision: To be a world class school system Mission: To ensure that each

HUMAN RESOURCES DIVISION Future-Ready Workforce Vision: To be a world class school system Mission: To ensure that each student achieves his/her highest personal potential HUMAN RESOURCES LEADERSHIP TEAM Chief Human Executive Coordinators

543 views • 35 slides

Secure Agile Development With FISMA Compliance https://www.fyrmassociates.com/ FYRM Overview

Secure Agile Development With FISMA Compliance https://www.fyrmassociates.com/ FYRM Overview Qualifications Performance Strategy Experience CPAR 4/4 Secure Agile Respected Partner CMS, DOE Knowledge Sharing FedRAMP

200 views • 16 slides

Alchemy 2017 Updates About me John Winter Co-Founder, Content Bloom

Alchemy 2017 Updates About me John Winter Co-Founder, Content Bloom j.winter@contentbloom.com +1 832 202 4508 Content Bloom Digital / Content Management Agency Offices in USA,

477 views • 14 slides

Strategic Issues Discussion ($90M & Above) Facilitated by: Ken Ross EVP/COO, MCUL &

MCUL & Affiliates | 2015 Executive Summit Strategic Issues Discussion ($90M & Above) Facilitated by: Ken Ross EVP/COO, MCUL & Affiliates MCUL & Affiliates | 2015 Executive Summit Stronger Lending Heather Luciani CEO,

1.12k views • 14 slides

The Trafficware Pod Pod Detection and Advanced Applications As a Means of Collecting Purdue High

The Trafficware Pod Pod Detection and Advanced Applications As a Means of Collecting Purdue High Resolution Data The Pod Bill Ische, Business Development Manager Chris Jannace, Detection Specialist 03 September 2015 A GENDA Pod Detection

1.04k views • 15 slides

EEC 181 Design Plan By: Christopher Bacchi, Andrea Lopez, Krysteen Terlouw Algorithm Flowchart

EEC 181 Design Plan By: Christopher Bacchi, Andrea Lopez, Krysteen Terlouw Algorithm Flowchart Software Profiling Runtime Stage Runtime (%) 1 84 2 12 3 4 Within Stage 1, the inner loop takes 90% of the runtime. Hardware RTL Block

899 views • 7 slides

Transition Planning Elementary to Secondary & Secondary to Post-Secondary and Beyond HCDSB

Transition Planning Elementary to Secondary & Secondary to Post-Secondary and Beyond HCDSB Special Education Advisory Committee Parent Information Night April 23, 2014 Jon Greenaway, Transitions Consultant / Social Worker Joe Trovato,

430 views • 30 slides

Download document

More recommend

Explore More Topics

Stay informed with curated content and fresh updates.

animals pets art culture automotive transportation business finance computer internet construction architecture education-career electronics communication

Application Security The source code perspective Authors: - PowerPoint PPT Presentation

Application Security The source code perspective Authors: Francesco Consiglio Marco Borza Implementation Challenges Iron Triangle Security as an afterthought The Secure SDLC in the Waterfall Model SDLC vs Secure SDLC Cost Reduction

DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and

OWASP Top 10 OWASP Top Ten meets JSF Andreas Hartmann Application Security Komponente

Application Security as a Service: Start Your Application Security Initiative in Less than a Day

Scenegraphs and Engines Scenegraphs and Engines Scenegraphs Application Application

Web Application Security Attacks on the Web Attacker Web User Application Web Database Web

United Way of Will County Application Training Application Process Application Site

Network Security Network Security Srinidhi Varadarajan Network security Network security

Application Security Management (ASM) August 9, 2016 CC Kermen Agenda About Application

Great Lakes Chloride, Inc. Direct Liquid Application (DLA) Direct Liquid Application (DLA)

Application Accelerators: Application Accelerators: Application Accelerators: Application

Transport Layer Security The TLS Protocol Transport Layer Security (TLS) Security goals:

Security, Security, Security Presentation to NSAI Consultation Meeting Chinese National Body

UCP GROUP Maritime Security Services UCP GROUP ONE SOLUTION ONE PLATFORM ONE SECURITY SERVICE

Xpanda security gates Security solutions Retail security gate solutions Industrial

A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security

OS Security Thierry Sans Security is a wide topic CSCD27 Computer and Network Security covers

Numerical Investigation of Summer Sea Breeze Using Updated Urban Aerodynamic Parameters in Kanto

Future-Ready Workforce Vision: To be a world class school system Mission: To ensure that each

Secure Agile Development With FISMA Compliance https://www.fyrmassociates.com/ FYRM Overview

Alchemy 2017 Updates About me John Winter Co-Founder, Content Bloom

Strategic Issues Discussion ($90M & Above) Facilitated by: Ken Ross EVP/COO, MCUL &

The Trafficware Pod Pod Detection and Advanced Applications As a Means of Collecting Purdue High

EEC 181 Design Plan By: Christopher Bacchi, Andrea Lopez, Krysteen Terlouw Algorithm Flowchart

Transition Planning Elementary to Secondary & Secondary to Post-Secondary and Beyond HCDSB

Explore More Topics

Sambuz

Useful Links

Newsletter

Mail Us

Application Security The source code perspective Authors: - PowerPoint PPT Presentation

Application Security The source code perspective Authors: Francesco Consiglio Marco Borza Implementation Challenges Iron Triangle Security as an afterthought The Secure SDLC in the Waterfall Model SDLC vs Secure SDLC Cost Reduction

DNS and Security DNS and Security DNS and Security DNS and Security DNS and Security DNS and

OWASP Top 10 OWASP Top Ten meets JSF Andreas Hartmann Application Security Komponente

Application Security as a Service: Start Your Application Security Initiative in Less than a Day

Scenegraphs and Engines Scenegraphs and Engines Scenegraphs Application Application

Web Application Security Attacks on the Web Attacker Web User Application Web Database Web

United Way of Will County Application Training Application Process Application Site

Network Security Network Security Srinidhi Varadarajan Network security Network security

Application Security Management (ASM) August 9, 2016 CC Kermen Agenda About Application

Great Lakes Chloride, Inc. Direct Liquid Application (DLA) Direct Liquid Application (DLA)

Application Accelerators: Application Accelerators: Application Accelerators: Application

Transport Layer Security The TLS Protocol Transport Layer Security (TLS) Security goals:

Security, Security, Security Presentation to NSAI Consultation Meeting Chinese National Body

UCP GROUP Maritime Security Services UCP GROUP ONE SOLUTION ONE PLATFORM ONE SECURITY SERVICE

Xpanda security gates Security solutions Retail security gate solutions Industrial

A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security

OS Security Thierry Sans Security is a wide topic CSCD27 Computer and Network Security covers

Numerical Investigation of Summer Sea Breeze Using Updated Urban Aerodynamic Parameters in Kanto

Future-Ready Workforce Vision: To be a world class school system Mission: To ensure that each

Secure Agile Development With FISMA Compliance https://www.fyrmassociates.com/ FYRM Overview

Alchemy 2017 Updates About me John Winter Co-Founder, Content Bloom

Strategic Issues Discussion ($90M &amp; Above) Facilitated by: Ken Ross EVP/COO, MCUL &amp;

The Trafficware Pod Pod Detection and Advanced Applications As a Means of Collecting Purdue High

EEC 181 Design Plan By: Christopher Bacchi, Andrea Lopez, Krysteen Terlouw Algorithm Flowchart

Transition Planning Elementary to Secondary &amp; Secondary to Post-Secondary and Beyond HCDSB

Explore More Topics

Sambuz

Useful Links

Newsletter

Mail Us

Strategic Issues Discussion ($90M & Above) Facilitated by: Ken Ross EVP/COO, MCUL &

Transition Planning Elementary to Secondary & Secondary to Post-Secondary and Beyond HCDSB