Application security and risk-based approach. From Shifting left, fixing fast, fixing first, lots of buzzwords around the industry.

Shifting left had success, shifting right and adding context is hot as the number of vulnerabilities pre-flight in an SDLC is piling up. Find your path in this modern, challenging. The talk walks trough a new risk-based approach on vulnerabilities called shift smart.
We will explore the difference between a vulnerability-based approach and resolution first vs a risk-based approach and success from real case scenarios.

Appsec Cali

AppSec SoCal Santa Monica aims to facilitate collaboration among software security professionals, developers, and business experts, to help them build cohesive organizations capable of scaling information security at a rapid pace to meet the demands of agile development.

This conference attracts top-tier talent and expertise from around the world and California’s thriving information security and management community. Attendees at AppSec SoCal include senior executives, technical experts, information security practitioners, and students seeking valuable information and networking opportunities.

The event takes place at the Annenberg Community Beach House, situated on the picturesque shores of the Pacific Ocean, providing attendees with ample opportunities for taking beach photos in their downtime and making their colleagues back at the office envious.

Agenda:

https://planetcybersec.com/091323-agenda/

Talk – Shift Smart – risk based approach on appsec

Francesco Cipollone

Shifting left had success, shifting right and adding context is hot as the number of vulnerabilities pre-flight in an SDLC is piling up. Find your path in this modern, challenging. The talk walks trough a new risk-based approach on vulnerabilities called shift smart.
We will explore the difference between a vulnerability base approach and resolution first vs a risk based approach and success from real case scenarios

Audience
* application security
* head of application security
* product security
* security engineers
* CISO
* GRC

Take away:
* Learning how to start measuring an application security program from risk approach
* Understand the concept of product
* Understand and apply how to involve the business
* Understand SSDLC and where to apply triage
* Understand and apply contextual elements to application security
* Understand which Threat feed is actually useful
* metrics for an application security program
* how to create a narrative around security with product security
* how to involve management/business on heartbeat of application security

Previous talks

Francesco Cipollone (Speaker)

Francesco is a seasoned entrepreneur, CEO of the Contextual-based vulnerability management platform from code to cloud Phoenix Security, author of several books, host of multi-award Cyber Security & Cloud Podcast, speaker and known in the cybersecurity industry and recognized for his visionary views. He currently serves as Chapter Chair UK&I of the Cloud Security Alliance. Previously, Francesco headed HSBC’s application and cloud security and was Senior Security Consultant at AWS. Francesco has been keynoting at global conferences and has authored and co-authored several books. Outside of work, you can find me running marathons, snowboarding on the Italian slopes, and enjoying single malt whiskeys in one of my favourite London clubs.

Linkedin: https://www.linkedin.com/in/fracipo/

Twitter: https://twitter.com/FrankSEC42