BSidesKC 2019  - Rebecca Deck - AppSec Tales of Fails (and avoiding them)
Channel: BSidesKC
Date: 2019-06-12

Manual application security testing is expensive. As a third-party consultant, you regularly are forced to deliver substandard test results to clients. No one wants that! This leads to depressed consultants, unhappy clients, and less secure software. Maybe the contract has specific language that makes complete testing impossible. Perhaps the client (knowingly or not) places impossible restrictions on the tester. Sometimes the software is just completely untestable. Only by examining the ways in which projects fail can we hope to improve. This presentation serves as a guide of what companies looking for manual AppSec testing should do before, during, and after engagements to get their money’s worth. There will be some real-world stories about ways that AppSec testing engagements ended in abject failure. Attendees who play some role in AppSec testing will come away with useful strategies to ensure their testing program delivers results, whether testing is performed by in-house or third-party testers.
Rebecca Deck
(Security Consultant at DirectDefense)

Rebecca Deck is a senior application security consultant for DirectDefense where she performs security testing on web, mobile, and client-side applications. Rebecca previously worked as a security engineer, incident responder, software developer, and soldier. Rebecca's current work focuses on identifying software vulnerabilities, writing exploits, improving application testing methodologies, and better integrating software security in the software development lifecycle.