| 9:00 AM - 9:30 AM | We all need to work together to speed up adoption of application security practices and to encourage (if not mandate) such adoption. There are many challenges ahead for AppSec teams, building a community is the best way to prepare practitioners to face them.
In this session you will learn:
  | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 9:30 AM - 10:00 AM | Successful application security practices need to bring people, process and technology together to enable software development teams to ship secure and ship fast - and this necessitates a new category of security practice. Application security, or AppSec, is an important field for security professionals. Learn what this all means from our team of security leaders. In this panel discussion you will learn:
 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 10:00 AM - 10:30 AM | For an AppSec program to be successful, software organizations need to undergo a cultural shift. But this change is complex and gradual. While this shift is underway, it’s easy to get overwhelmed with too many alerts and warnings from the diverse set of security tools deployed in the software pipeline. Organizations making this transition need guidance on the best approaches that provide improved AppSec with the resources at hand. In this panel discussion you will learn:
   | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 10:30 AM - 11:00 AM | An important aspect of the organizational culture shift needed for improving AppSec is the critical role of security champions. Security champions are your AppSec specialists who help lead, mentor and train the team. These champions help share the load with the dedicated AppSec leaders helping magnify the impact of AppSec in the organization. They lead by example for the development team and are pivotal to driving the cultural change needed for security. In this session you will learn:
  | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 11:00 AM - 11:30 AM | As organizations look to develop and improve their AppSec program, questions arise such as “What are others doing?” and “How do I compare?” Luckily, these questions and more are answered in the results of the 2022 State of AppSec Operations survey. Security programs mature by learning from leaders and laggards. Understanding where your organization lies in terms of AppSec maturity provides a pathway to improvement. In this session you will learn:
 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 11:30 AM - 12:00 PM | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 12:00 PM - 12:30 PM | Budgets are tight, but security risk is real and looming. Investing in AppSec is important but needs a business case to get funding. There’s a solid return on investment for each AppSec dollar spent, however, the hard part is articulating this message to stakeholders in your organization. Building a business case means creating a solid value proposition for your organization based on tangible examples and data. In this panel discussion you will learn:
  | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 12:30 PM - 1:00 PM | Recent examples of security attacks in the software supply chain have made it clear more needs to be done. Recent examples such as the Log4j vulnerability and SolarWinds attack have raised the profile of these types of incidents. The increasing use of off- the- shelf and open source software has created a greater attack surface for applications. However, there are ways to manage this risk with due diligence in purchasing and reusing software. An important component of supply chain risk management is software composition analysis (SCA) and the software bill of materials (SBOM) which provides a way to communicate software composition both internally and externally to your organization. In this session you will learn:
   | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 1:00 PM - 1:52 PM | Mergers and acquisitions (M&A) are commonplace in today's high tech world. They are complex transactions that expose companies to risk - especially security risk. This is particularly important for software organizations as mergers and acquisitions mean assuming the inherent security in the merger. Acquirers don’t understand the scope of the risk they open themselves up to so due diligence is critical. Understanding the potential risks as well as potential solutions to manage this risk is critical knowledge before M&A begins.
   | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 1:55 PM - 2:25 PM | After a great first day at AppSecCon 2022, Laura Bell pulls together the day's themes and digs into our role as application security professionals in this age of amazing technological innovation. By looking at the ways that technology is impacting our lives today, we can understand how powerful our contribution can be when securing the life-changing technologies of the future.  | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 9:00 AM - 9:30 AM | Application security operations tend to be difficult to scale and can be painful. Application development has changed radically: From waterfall to Agile development and from monolithic application architecture to microservices and software delivered at the edge. Software development is growing exponentially and the speed at which software is created has also accelerated dramatically. We have accelerated from yearly releases to multiple releases every week or, in some cases, every build. However, approaches to application security have not transformed to keep pace. Application security professionals increasingly find themselves falling behind—and many are forced to piece together manual reporting and workflows across siloed security tools as stopgaps. In this presentation you will learn:
  | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 9:30 AM - 10:00 AM | Securing software in a world moving at the speed of DevOps is a monumental challenge. To take this challenge head-on, more than 25 innovative security leaders came together to build a community and create the Purple Book. This free resource documents current software security challenges and approaches that work with the goal of helping people and organizations everywhere work toward simplifying security while staying protected and compliant. In this panel discussion you will learn:
   | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 10:00 AM - 10:30 AM | Zero-trust has recently come into focus as a powerful tool to combat the recent explosion of cybersecurity attacks. However, developers new to the concepts and framework are left with more questions than answers: What does the death of “trust but verify” mean for developers? How does zero-trust relate to DevSecOps? How can developers work within a zero-trust zero-trust framework while still maintaining agility and flexibility? Join this session to get these questions answered and more. In this session you will learn:
  | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 10:30 AM - 11:00 AM | Security is the hottest topic in application development; it is literally headline news. The job market is ‘hot’ and companies in all industries are hiring cybersecurity professionals. In order to seize this opportunity, how do you maximize your impact? An important part of making headway in this new space is building your personal brand. Your brand will help you stand out from the crowd and open up new opportunities and career paths. Start building that AppSec brand today. In this session you will learn:
 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 11:00 AM - 11:30 AM | 1 Most SaaS service providers have adopted a microservices-based architecture with an API-first approach. Engineering and product leaders mandate that teams innovate at a rapid pace to keep up with hypergrowth. To keep up, development teams have embraced Agile methodology for product development and have adopted DevOps and DevSecOps practices. DevSecOps seeks to shift security left in the development cycle and, in this presentation, we will talk about practical approaches for making DevSecOps successful. We will discuss all the security and compliance controls that need to exist in a typical CI/CD environment both from a process and tooling perspective. Our talk will address these challenges both from engineering and security perspectives.   | 2 For an AppSec program to be successful, it needs to be operationalized. This means the solution provides the necessary visibility, collaboration and productivity with tangible results. The question then becomes whether to build or buy. Is it worth building and maintaining your own AppSecOps platform? Or is a prebuilt vendor solution more cost-effective? In this panel discussion you will learn:
   | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 11:30 AM - 12:00 PM | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 12:00 PM - 12:30 PM | Whether you have SOC2, HIPAA, GDPR, PCI or ISO requirements for application development, governance, risk and compliance (GRC) is an essential practice for your organization. You literally can’t ship without compliance, a large undertaking with serious budget and schedule implications. Software organizations struggle with scaling and managing GRC while also modernizing their development pipeline with Agile and DevOps and Cloud deployment. In this panel discussion you will learn:
   | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 12:30 PM - 1:00 PM | 1 The modern approach to software delivery changed from annual releases on dedicated hardware to monthly, daily or even continuous releases deployed on dynamically created and configured containers in the cloud. To keep pace with this rapid and dynamic nature of modern software delivery, the approach to vulnerability management has to change. The focus can no longer be on infrastructure and perimeter defense;, consideration is needed for the application and rapid release schedules. There needs to be a holistic view of vulnerability management that spans infrastructure and applications. In this session you will learn:
| 2 The quest to identify and address risks in someone else's software product is not for the faint-of-heart! It requires close coordination, cooperation and, ultimately, consent from your business partners - both inside and outside of your organization. How do we standardize an approach to managing software supply chain risks that is both reasonable and fair to our suppliers - and business units that rely on them - without compromising on security and exposing our organization to unacceptable risks? In this session you will learn:
   | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 1:00 PM - 1:30 PM | 1 A successful AppSec program begins with the realization that security is, first and foremost, a people problem. Tools and processes don’t improve security alone. Hiring great people, along with training and awareness, is a key part of AppSec success. Finding the right kind of team players is key, those who can work across organizational boundaries and excel at facilitating the collaboration between security and development teams. In this session you will learn
 | 2 The recent Log4Shell and other Log4j vulnerabilities shook the industry. Security teams and developers around the world have been scrambling to respond as quickly as possible. Despite this response, the impact of these vulnerabilities will be felt for years. Log4j isn’t the first significant zero-day vulnerability, nor will it be the last. An important step for improving your security posture is learning how to prepare for the inevitable, the next black swan event, and ensure your organization is able to respond fast and respond well. In this panel discussion you will learn:
   | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 1:30 PM - 2:00 PM | Join your peers to wrap up two days of exciting AppSec content in this closing session of AppSecCon. Although lots of ground has been covered, there’s still lots to do and discuss. How will your AppSec plans change after the conference? In addition, the session will talk about the community we’ve created and how to carry this forward. We hope you’ll continue the dialogue at the Purple Book Community, a place to connect practitioners and equip them with the expertise to embrace secure development practices, solve ever-evolving challenges, and ultimately democratize software security. In this session you will learn:
  | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
© 2022 Techstrong Group, Inc. | Privacy Policy
