Workshop: Scaling your AppSec Program with Semgrep

▬▬▬▬▬▬ SHOW SPONSOR ▬▬▬▬▬▬

▬▬▬▬▬▬ Abstract & Bio 📝 ▬▬▬▬▬▬
Between Agile, DevOps, and infrastructure as code, development is happening faster than ever. As a security team, it can be tough to keep up.

How can you help empower your engineering counterparts to ship software quickly and securely?

An increasingly popular answer is secure defaults - make it easy to do the secure thing, and hard to do the insecure thing, whether that’s parsing XML files, interacting with the database, authorization, or any other security-relevant functionality.

Done properly, secure defaults (also called “guardrails” or building a “paved road”) can effectively eliminate classes of vulnerabilities from ever occurring in the first place, effectively scaling your security team.

The power of secure defaults has been praised by established companies like Netflix, Google, Facebook, and Microsoft as well as rapidly growing mid-sized companies and even start-ups.

“But I don’t have a FAANG-sized budget or headcount, what can I do?”

This workshop will show you:
How to start getting security coverage of all of your repos continuously in CI in minutes
Best practices in rolling out continuous code scanning - what to focus on, what to ignore, and how to maintain good working relationships with development teams
How to use this scanning to enforce secure defaults across your org
How to enforce security best practices unique to your organization using the open-source static analysis tool Semgrep, around nuances like authorization, authentication, secret management, etc.

This workshop will be part big picture ideas and best practices, and a lot of hands-on examples and demos. You’ll leave with some insights, open-source tools, and actionable tips to get started immediately.

INSTRUCTOR: CLINT GIBLER

▬▬▬▬▬▬ Useful Links from Clint Gibler 🛠 ▬▬▬▬▬▬
▬▬▬▬▬▬ Hosts 🎙️ ▬▬▬▬▬▬

▬▬▬▬▬▬ Connect with Us 👋 ▬▬▬▬▬▬