Engineers & Exploits: The Quest for Security
Spyros Gasteratos and Andra Lezza explore strategies for integrating security into the product development lifecycle through threat modeling, OWASP Cornucopia, and collaborative developer workflows.
Summary
Integrating Security into the Product Lifecycle
Security is often treated as an afterthought in software engineering, leading to friction between security architects and development teams. Fostering early collaboration and establishing shared mental models helps embed security directly into developer workflows rather than imposing late-stage blockers.
Practical Threat Modeling with OWASP Cornucopia
Utilizing lightweight threat modeling frameworks like OWASP Cornucopia allows engineering teams to identify actionable security user stories. By balancing mitigation workloads with business context, development organizations can achieve measurable security by design without derailing sprint velocity.
Related talks
App Sec Village·24 min
Peiyu Wang
Real-world attack vectors, threat modeling techniques, and vulnerability case studies for penetration testing decentralized Web3 applications.
App Sec Village·45 min
Mario Areias
Uses an iconic sci-fi battle station case study to teach structured threat modeling and architectural risk analysis.
App Sec Village·36 min
David Sopas · Paulo Silva
Breaks down the OWASP API Security Top 10 vulnerabilities with real-world examples and remediation advice.