Debunking the AppSec Silver Bullet Myth

Logo
Presented by

Brittany O'Shea | Product Marketing Manager at Veracode

About this talk

There is no AppSec silver bullet. Each analysis type – static analysis, dynamic analysis, software composition analysis, interactive analysis, and penetration testing – has a role to play, and they all work together to fully secure your application layer. The different analysis types have different strengths in finding security issues, and they lend themselves to different stages of the SDLC. For instance, we recommend that you shift left to catch issues as early as possible because they are cheaper to fix. However, when scanning only parts of the application, you don’t have the full scope of the application. It’s like providing feedback on one chapter of a book without knowing the other chapters. You can provide feedback if it makes sense, but you can’t assess it in the context of all of the other chapters. The same is true for application security. That’s why you need to scan parts early but also scan when the application is fully assembled. Join this session to find out: •The strengths and weaknesses of the different AppSec analysis types •Where each analysis type fits in the SDLC •Why pipeline integrations are critical
Related topics:

More from this channel

Upcoming talks (0)
On-demand talks (395)
Subscribers (31074)
Veracode is intelligent software security. The Veracode Software Security Platform continuously finds flaws and vulnerabilities at every stage of the modern software development lifecycle. Prompted by powerful AI trained by trillions of lines of code, Veracode customers fix flaws faster with high accuracy. Trusted by security teams, developers, and business leaders from thousands of the world’s leading organizations, Veracode is the pioneer, continuing to redefine what intelligent software security means. Learn more at www.veracode.com