Improve App Security Through Collaboration Between Engineering and Security
Channel: Endor Labs
Date: 2023-12-05

In this session from LeanAppSec Summer 2023, a panel of industry leaders discusses how to improve collaboration between security and engineering and how to share responsibility for securing applications.

Panel: Stacy Hong (SVP Engineering, Okta), David Tsao (CISO, Instacart), Rachit Lohani (CTO, Paylocity), and Varun Badhwar (CEO, Endor Labs)

0:00 - Introductions 
2:29 - How security leaders can get buy-in from engineering
3:44 - How engineering leaders can prioritize features vs security issues
7:10 - Expectations vs. reality of "shift left"
10:29 - Scaling security with tools and processes
14:20 - Governing selection of open source software (OSS)
17:35 - Balancing between "fail open" vs. "fail close"
21:45 - Responsibility for OSS selection, SCM security, and secret detection 
27:40 - Preventing leaked secrets with tools that optimize for developer speed
30:27 - Advice for starting an application security program
34:20 - Improve AppSec understanding of SDLC by embedding engineers in product teams for rotations
35:57 - What keeps these leaders up at night
39:25 - How the industry needs to improve

—Learn More—
What breaking changes teach us about security
https://www.endorlabs.com/blog/what-the-github-outage-teaches-us-about-security

How To Evaluate Secret Detection Tools
https://www.endorlabs.com/blog/how-to-evaluate-secret-detection-tools

—LeanAppSec by Endor Labs— 
LeanAppSec is an application security educational program by Endor Labs. It includes quarterly live events featuring industry experts (like this video) and on demand courses.
https://www.leanappsec.com/
Follow on LinkedIn https://www.linkedin.com/company/leanappsec

—Endor Labs—
Follow Us on LinkedIn
https://www.linkedin.com/company/endorlabs

Learn More About Endor Labs
https://www.endorlabs.com/