Secure software, start appreciating your developers!

Video in TIB AV-Portal: Secure software, start appreciating your developers!

Formal Metadata

Secure software, start appreciating your developers!
Title of Series
Part Number
Number of Parts
CC Attribution 3.0 Germany:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Release Date

Content Metadata

Subject Area
Over the years, I have been visiting attended quite some a number of security conferences and got more and more frustrated. Bashing developers, blaming them for writing insecure software, not going to security conferences. It is easy to blame, but what’s the point? During this talk I will show why the security community has failed to connect to the developers and, more importantly, how to do it right!

Related Material

Metropolitan area network Suite (music) Dependent and independent variables Software developer Software developer Multiplication sign Lattice (order) Independence (probability theory) Software Information Summierbarkeit Information security Curve fitting
Computer program Complex (psychology) Observational study Multiplication sign Execution unit Maxima and minima Mass Plastikkarte Mereology Product (business) Facebook Frequency Mechanism design Robotics Software Energy level Liquid Diagram Endliche Modelltheorie Gamma function Physical system Mobile Web Area Metropolitan area network Arm Closed set Projective plane Digital rights management Network topology Pattern language Complex system
Complex (psychology) Computer program Matching (graph theory) Code Multiplication sign Software developer Control flow Cartesian coordinate system Disk read-and-write head System call Value-added network Product (business) Wave packet Goodness of fit Robotics Software Writing
Computer program Digital photography Scaling (geometry) Term (mathematics) Software Data acquisition Projective plane Price index
Point (geometry) Area Metropolitan area network Server (computing) Validity (statistics) Executive information system Multiplication sign Inclusion map Word Network topology Software Energy level Endliche Modelltheorie
Computer program Asynchronous Transfer Mode Game controller Electric generator Software developer Virtual machine Set (mathematics) Insertion loss Digital rights management Integrated development environment Hypermedia Telecommunication Software Universe (mathematics) Software testing Fiber bundle Information security
Functional (mathematics) Link (knot theory) State of matter Multiplication sign Maxima and minima Mereology Storage area network Semiconductor memory Software Entropie <Informationstheorie> Software testing Error message Traffic reporting Information security Descriptive statistics Dependent and independent variables Standard deviation Inheritance (object-oriented programming) Executive information system Software developer Stress (mechanics) Cartesian coordinate system Sequence Category of being Word Digital rights management Process (computing) Formal grammar Probability density function Computer worm Row (database)
Process (computing) Information systems Multiplication sign Software developer Software Line (geometry) Gamma function Mereology Traffic reporting
Ocean current Complex (psychology) Cone penetration test Code INTEGRAL Multiplication sign Execution unit Maxima and minima Binary file Estimator Operator (mathematics) Software Software testing Gamma function Extension (kinesiology) Information security Area Wechselseitige Information Software developer Binary code Sound effect Plastikkarte Cartesian coordinate system Limit (category theory) Process (computing) Vector space Object (grammar)
Covering space Software developer Software developer Multiplication sign Expert system Frustration Lattice (order) Dimensional analysis Inclusion map Goodness of fit Digital rights management Arithmetic mean Process (computing) Software Personal area network Figurate number Gamma function Information security
Metropolitan area network Code Decision theory Software developer Projective plane Morley's categoricity theorem 2 (number) Template (C++) Integrated development environment Different (Kate Ryan album) Software Statement (computer science) Videoconferencing
Metropolitan area network Word Process (computing) Code Information systems Software Maxima and minima Cartesian coordinate system Graph coloring Code God
Metropolitan area network Software developer Software Software testing Cryptography Information security Traffic reporting Number
Optical disc drive Voting Pattern matching Haar measure Code Software Moment (mathematics) Formal grammar Metric system Position operator Software bug Thumbnail
NP-hard State observer Group action Code Multiplication sign Orientation (vector space) Plotter ACID Frustration Formal language Information security Area Theory of relativity Executive information system Information systems Software developer Constructor (object-oriented programming) Shared memory Bit Maxima and minima Arithmetic mean Process (computing) Order (biology) Right angle Summierbarkeit Quicksort Probability density function Functional (mathematics) Mobile app Computer file Branch (computer science) Inequality (mathematics) Event horizon Product (business) Number Wave packet Goodness of fit Term (mathematics) Software Boundary value problem Traffic reporting Dependent and independent variables Plastikkarte Database Line (geometry) Cartesian coordinate system Performance appraisal Word Integrated development environment Query language Universe (mathematics) Statement (computer science) Fuzzy logic Musical ensemble Table (information) Pressure Local ring
Point (geometry) Functional (mathematics) Observational study Token ring Code Multiplication sign Disk read-and-write head Distance Event horizon Mathematics Different (Kate Ryan album) Software Cuboid Devolution (biology) Gamma function Information security Traffic reporting Computer architecture Vulnerability (computing) Standard deviation Dependent and independent variables Software developer Feedback Mathematical analysis Line (geometry) Cartesian coordinate system Uniform resource locator Software Self-organization Video game Cycle (graph theory) Factorization
it's not actually I did attend the conference but not basing
development I have been a developer myself that she's talking about because really got relevant quantities every time everybody especially developed they do it wrong they come in here and I fed opposite because I was a different amounts of developed and I had split between developing and document security but my heart is still for the developers and then we have it is the best it hurts when I'm on the ground so I was in the conferences all people's responses in nice suits and long kinds of the hidden alluding to the next meeting like people it's thought that developers etc. getting angry at all is imminent but that's what I thought about because if it would we know developers we would have not lost roughly at 1 so
actually my ancestry or I come from is completely different I don't have a nite achieve history management I didn't study I could solar 17 of things and also trained mechanical injection molding judge Monday it's there for a very handy I moles stick with closed and achieve liquid plastic will be rejected the close it opens the parts will be retrieved by an beauty program robot sometimes given them be in there robot robot arm removed from the mold mall closes and again present projective because it is the mass production timings Facebook expensive so fast I can produce the stupid products so I was a mechanic like of trees monkeying what hands and that's really great because we did also limited in that correlates with the medics hydraulics and about as robots and I like himself had like things like moving by themselves period so I like a robot I very quickly become responsible will keep the world was running a of time and that is a problem because you want to save time the and the robot arm into the 2 most mold before the all old and it goes in the mall before the robot arm has left them all there is a slight problem timing what so what if the model is not opening a robotic arm rests into the mobile robotic arm problem a but less expensive but OK this is really funny and impressive if the mole closing enrollment on the cylinder and have a different cost but then develop he was to be developed so I was monkeys and he was to develop but it was then the robot gobbled please please by them all he can stop like relating use of what have you done this time I could is then that should not be possible to I logic and so the problem with this pattern so what I did that myself programming a downloaded the level diagrams medical piling and reading it I found what was a really stupid problem and offers great because they I found the re-export most of us have heard of it I have no I
was year I was told so I went down there up there to the office because we're not only in the production area I hand there was this unit of the diagram and said I found you for what you did wrong but me hod was he had we know about chemical threats and that is somehow how to contribute thing I found this week and I broke yourself I am so smart and cooler you and smile you because I can break but we forget about the complexity of systems we complex systems
sometimes we forget what all we need to think about how can they not see this how can this happen and
complexity it's very complex to write good code if it's robotics many possible moving the same time is an application so when you do that much complexity sometimes you forget to look at or just you don't find it until it had been known train so matching development of quality because the product is that of can you build it yourself many times it means you conferences and there's another cool head of and so cool and break stuff and here modernized tightens grip you can download it don't look at the code because I can't help but think about it but I can't do what you do but I'm not because break that was the same thing I did the 1st call refused to C programming I can program builds but I could find sport of every the sentence as if you were right
column misuse How can you have the problem actually a indication that's why a lot scale projects they're not trade terms of had a problem I only knew the post but think about
mind set the thing about reminds me this photograph I tokenization where they're much less bicycles and Netherlands and only by successful that was a place where it says no bicycle too it's not always open you might mention is like dancing about at and sometimes when not saying something you just assume it had been trained to develop a that's is they just come to an adult programs and not be able to say how to fix it will not help the you really cool
had disappointed collective because they're all and it should be
animated but it doesn't work and so on and so am so cool look at all the levels I have to my proposal for readability I really cool I little like that the guns and should be duplicated so maybe I'm guy have have
qualities installed I use below the army that everybody can have now actually I had 1 customer receives of another company used on taught against server on home area these are all the assignment and how can you do it it's really really bad the just haven't told that doesn't make you will have the and here I was partially to oversee the aperture and you don't do like all of whom had had to see the answer my tree times brighter still don't know the very good but the falsity was because in a TTS challenge evidence has availability of words will be charming all you need to do is find digit token of you don't have to understand the validity is just exploited and mitigation model thing but gives the most but there's no right so I need to tell them a couple of points that's a lot of papers as the the article had a ankle but is it like that like you
all it then make free you have to cool story to make for you to help them they then stops
only made a little like many of and many and coming I'm getting all the bundle of loss by the age of the universities and this is like the generation gap gets bigger and bigger and it's very hard to find developers security a Pemex environments the ponds and the then developers who is accused of a set of course not what do developers the developing and I developers environment with a big problem because you're union available for half a year now become media developed 2 years and then you have to be seeing develop otherwise you slow and then using developed a prior career path the most immediate as in your developer node and you have to be and I think that all of manager because then you get more money soviet killing so much knowledge because there's no clear across available so you see that developer and then move on otherwise that you like so appreciating being built in the in the 4 years something missing and further security tests even real because they are and the program is all my fault and I had stuff but the experience that like on a lot of young people magnets moments should be like that is some standard communication like me and I'd hear of another better control on the on the American inventor from above a beautiful summer in the basement beer or doesn't mean the machine but they have to learn the talk that's 1 thing but we have to learn to talk to other people other minds the they come with Jake this
is all broken hot so errors the variable that you with this yeah good it's broken in
people say no this is all that amazing reports that is what have you done what did you do as normally important something in the government's functional testing is really a high standard really all funded as of a more technical and that the balloon security but they're really good at estimating how much the texts of formal applications whenever security test there's always time because security is expensive we do play process 1 memory for warming records that how much stress you do that because it's part of the half the reporting 1 half days or so we have 3 days left move but you do 3 days running tools is now and then what you do is retire on that find the false positives and stick them and then get report so when I receive a regional and almost never get the whole intermediate 5 because I want to see what you don't know what happened so if a development things hey let's try to myself right I get the same tool the same movement are on the same test and uh pack on side those of other but since you have to fix it don't save a disorder that fell specific and whether findings I get different of findings so what happens is those have you seen them have you ever so the Reber all should say those findings has been reported but that of are response when should Mr. I began top sequence pdf report go Canada was broad and follow then because yes I have a link was a payload so I can level my obligation because then the link doesn't work so I click the link and hold application is the same state so this a words than I can see what this property and I get a general description what should be fixed does it have to use user-friendly not really I need a description a what has been done understand what the pillow stoneware why the name of the tissue so if the parent wrote many times this depending on the state of the then the application for the PDF the other thing is for management my Special
good there had the enlighten me talk to me
because when you get a report I get line why are we paying out of to develop but their pledge because developers have not much from school you as a developer value of has some of the genome of this again I understand other been rather developed but you make people proud of what you to do a better job it is available as part of this is apparently the mom I appreciate that you care about and that's what you need people do care about what do and co-developers care about America but have there so many times why because all the
different priorities the users like developers that I at this how we have done this for as the more intuitive he has signed the fleshy application it has be limit yesterday so there are good and that expensive you would be outsourced to quality of mutual nobody developers but still they rely on them so that's crazy all plants and sweat and tears It's all when you get the thing we get past you also time with the amount of time it because me set apart together you said the 3 weeks we sold it for 2 weeks please make that I had a serious crime abuse company warehouses so far I that was developed that estimate from how many hours you think is a because will take to complete so I give back to them comes from community so you it has to be 250 less binaries without a shred something through you got this safe to 150 hours so you won't have lots of a but then you realize he talks to me what is just the that you have no weapon effects this is about 0 yes it's very impatient to get so what you got my judgment that what you asking now you said to me is not that OK just and we would like I would talk too much of it OK to have fun he knows me appreciable to an extent that experience this is a condition of
a the red card we do that all the 3 so 1st to talk to test like the problem dozens of tests are people became popular knowledge operations in an area that's a strength of the developing stopping testers and then we further down the basement room operations so now on integrated so we have continuous Avery I hear comedies like 70 17 a date then come security stop we 1st recall refused the demand test you other the test and then they get approval and you can really doesn't work that integration anyway not right any for it holds the whole chain and be you're a developer you vector in a cone you have to go funded you develop now and then something comes by you know 3 months ago he developed this piece of code is not a lot of health-threatening thing I was working out and the thing 3 months ago what did I do that I have a very rare perceptive time it has innovations will be I have no idea where bin 3 weeks ago I I been yesterday but on the unit developing the thing all the complexity of the cold that was really to go and you have to fix something not only takes time to fix it objectivity of current process and to get all the way make in the all process something about how the different the situation will be led initiative known that's him at times I come to companies have more implementing secure development areas bonds that colleges security why because I use it said no no I'm here for you radical refused I always play I have to be talking to the team that MIT like not only what is an appropriate you don't have property and so they don't do it when you're doing it but I don't do it not issue against I do together with the whole best who knows support better than developed by this step code that capture so we fail maybe approach them securely fails how many how to deliver the reports that but I thing about how we can improve at top I know it's
very scary to talk to other people I wasn't a good job world but good passion about security
professional development what their heart is full become amounts with the same level as and last developing a lot security of the top 2 % started talk to people on status of a and don't always about security cover things that concern I don't know if refused intake suffered the you did the 1st meetings always was the manager what do you really talk to professionals and managers from Everything dimension wants them to say so that's all I want to hear and so I think make those domination have paid for means smoke because a melody to outside and like figure then you all the frustrations because they know you understand you know you have been in the same place you have developed another security I come to school have high quality tools and take off no I think about what I felt the pain so u equals is out there now manager Ron Wyden signal you all the frustration when understand you feel the pain you can be actually they're called what are the get things changed according proved to have time only because you the external experts calendar management you have to fix it so you actually had been developed into improved they have
brains just the trigger the 2 of them the way they understand they have to be and that's something I really when I got involved all of 2006 that's the longer again all and it was developed as always was therefore developed a lot of executed conference or heading toward now it was a community of developers heading each other to write secure code and all 1st mistake was really black and white was the finding fighting and prevention of unsecured code we live we understood it is not possible to make 100 seconds to to secure code so the intention is a statement I think but 2008 saying from make them risk visible to the business so they can the right decision but what I found all lot things furious later we have categorization of our project that it was parade and defender I was developed as was a template to build I'm a developer so even call us coming from the development environment I think that we understand what if there was a you develop I believe that I did have much the undeveloped something different probability somebody would break some of the other not thinking it should would have say find creative a so make them the
heroes and you have to have any of your videos have all this completed the is the knowledge but every you has been born plant and he meets again make that was used here to that's all they are how to
presented fuck them the evidence
laughter of balloons needed on like having don't be the guy who takes
a job for me to believe I said that there was blood sweat and tears depression it's in the as if you appreciated and it's in the code is they were word I was this idiot who spent 8 hours because of a lot of work longer and offers coding and other stuff I didn't like and fixed German Thomas the whole might improve on color because I want to be proud of my code and I know a year later the McCombs that on and you do in year go there's going to be a debate the code like year a half year ago isn't all my god you do is good that means you're improvement so reader child look at the child and see what's going on itself not taking question from question I sort of the was because from other the code that application essential we come down and take the children you don't have to wonder why semantic that invalidated should and turned them relatively small paid more attention to be the best that was originally can have so
understanding talking to understand what is the business
what is that was intended companies so what do you do about security and this still exist as a nothing and then I can say I don't believe you what knowledge nothing is secure yes because not tell assesses security label on it in front of test that also you know don't because these 2 guys who did the greatest number of mistakes securities cryptography is complex is the cool black magic of any of the security test is this development team the external or even in a different department that's a security all dressed in black with the black magic and outcomes report so what is the developers tools the use they care about quality and answer quality
Institute is not that different because it's about here should not be able to do they have their own best
was the metrics like the grammar always said that the pope quality tools they have to perform such tools and that's all constituent is to treat them the that they would travel European the or find bugs and I have a summary digital is the brave improves it takes away the low-hanging fruit and integrated into different so the moment I check the code and Woodland it's 5 is ligand like Halo done to get a vote on the bill because we forget that there was a odds that pattern match positive thumbs up a projecting coat rejected it's good thank you appreciate make me laugh make
and constructive improvement bit by bit while investing them saying this is local reports as PDF reports I area with frustration when it comes that developers in and I say how the the number the report of what then they tell you about the report sitting there with you as seasonal and put your pens down the telling the truth and didn't cost extra if this security guy who doesn't call reissue executed review on is not willing to explain what he did what's going on with the resistor is he afraid that share knowledge security is not that special and he wanted the me wait a minute you're going to customers explain about tools and methodologies that the yes they do but but then you will be obsolete 1 time at all and we look forward to put back receive a feeds on table pool was nice and all the but I think we will have this when if unicorns rainbows and various because there's so much new developers every year training How did 3 look at the most simple code example handle world is for the bottom branches the event of what it might you went to the court orders from job 24 hours whatever language and followers and even order calling songs that you this is is wrong is simply not secure your design yes but we have a little remarks in this code is not meant to be in production this is another word I teach at university that column about prepared statement pomanders queries and DBA say yes that's how we was the really want you to talk databases of fuzzy qt if it and then acidity of the pressure like that have there but this is how he taught us to different but come because the teachers and universities they have to call obvious new technologies that they could what a language in 24 hours they have to learn it making from glasses and then teach people than expensive and the developers should be trained by developed new technologies like at development who you was diplomats money the younger people right the sort I have 2 teams there like 25 26 you all alignment of the sum of the agents like funny I could be your fault that German action always have to give up to our attention but I want you know guys 52 inequalities school we have 52 we you'll die and quality the doing cool stuff at development history job on for 15 years given those the mobile apps the commander so all that new is and you need a new guys who pushing the boundaries are really going for but then everybody the young guys and girls from down to to live you need all the has made these animals smart idea so evaluation of agents and that's very very important for a good team for security team and the development of so to make the story when I delivered secured report to right of and I have a good this right I cannot write novels otherwise I would have to draw this but tell them what how I experienced applications and my right of Allied disembarkation despite the shortly sultans aimed to write down what I think what it means that we test it's slow moon there's no edge sorting out let's see the the code and then another functionality all I can upload a file a bigger than 10 MB and on its relations with the red what will happen if it were 10 5 5 MB was 1 line in make must then you think process so they can replay never much more understand and it's what tell the story teller nicely tend personally I really had a hard problem time understanding why some people charged of money for the security tests the changed additionally for delivering the report it's a team effort
security cannot be done by 1 refinement to just wasn't company and 1 in terms of the guys at all the of what is going on security might be interesting discovery in environments I was also that there's no security requirements so can we have 1 of your team so that OK the guy team called me like wanted it to extend it again 7 dB problems that they are developing and expect me to do the security of work is a team effort in my own son minimalism knowledge of the development women start coding understanding about opaque claim orientation coal quality for a that finale such observations that I enjoy watching him residual plots of some of the stuff you know is interested so if the from the next stage here is the book reflect thank you so every time it seems like file was for these music but is the so-called meaning what that security is what other security cannot give to other people securities everybody's responsibility this was that made
single well if you are happy about it of functionality written him but it's only can be doing what it should do best in the location of the American where Jews company has been hacked and of course if no internal development for the oscars so for developed countries coming in the middle of the last application software it's head that the distance to the when is not recommended because it going to be the entrance of money we so you because it also known what abilities and you have them in your code to should should know the responsibility change safety road trip standard code renewed events of 100 to describe that the devolution of to something else we also define the time technology living time I come to companies about integrating security into them life cycle what everything's about stars and technology to solve all problems I had a guy from the Netherlands but this big organ about preventing the islands so I spent about poetry few study called analysis use or disposal bad code include tokens are not OK start again to make you understand a tool helps you but the team doesn't mean anything by itself the talk will help you really need tools that easy access these in the port of Boston the report and early feedback but all the tools that are there the only confined technical problems marks for the condo is flawless function for aggression demographic in normally asked the audience so pockets take the problem of robbing a factor problem 40 think was more a good closing them box of flaws was examined Fhloston by this architecture pick people entities 50 50 hostile abilities we could eliminate by different they're looking at a function to understand that is like the common sense but we our follows you on to box all the technologies follow the party tubulin about but the functionality you only can find the using your brain political befriended for 1 line of code but just looking at a function the thing wouldn't be that small if
you're gonna compute explains understandable what you follow the weaknesses you can't explain to the problem initially the simple maybe you have understand just having a tool it's not enough you need understand that something right all was when I was and involvement of all that has have a separate convention was taken the barrier-free always challenges it's efficacy each year for this difference what it's not about a global market you upload history better we have 10 points the 1st 3 points go 1 explainable ability another 3 points you get for exploitable but a get 4 points for tell us the mitigation this takes answer for the real people behind is more effort for this week community so that hundred people you doing all free or what the challenges but also hundred people the teacher and telling people about security that's all we need thank you for the


  433 ms - page object


AV-Portal 3.19.2 (70adb5fbc8bbcafb435210ef7d62ffee973cf172)