Look Who it Was Random video

Securing Software’s Future - Timothy D. Morgan - OWASP AppSec California 2015

206 views · Published 7 May 2015 · 48:21 · Indexed 6 November 2026

Channel: OWASP Foundation · 2015 · Science & Technology

Watch on YouTube

AppSec California 2015 - Day 2, Track 3, Slot 4

Title

Securing Software’s Future: Why API Design Matters

Abstract

Writing secure software is far cheaper for society as a whole than fixing vulnerable software after it is released. Teaching developers how to write secure software can be very effective in the short term, but over time security knowledge becomes less relevant, some security-conscious developers move into management, and additional uninitiated developers join the work force each year. While secure software development training will always play a role in helping secure application development, are there ways we can prevent even the least security-savvy developers from regularly shooting themselves (and their customers) in the foot? Yes. By providing development environments and APIs that subtly guide developers down a secure implementation path, we can prevent whole classes of vulnerabilities with very little effort. This talk will discuss the properties that tend to exist in safe development environments and will propose some guiding principles that API designers should consider.

Bio

“Tim has been taking deep technical dives in security for over a decade. In that time, he has been credited with the discovery and responsible disclosure of numerous security vulnerabilities in a variety of software products, including: IBM Tivoli Access Manager, Sun Java Runtime Environment, Google Chrome Web Browser, OpenOffice, Oracle WebLogic Application Server, and IBM Websphere Commerce. His current research interests include applied cryptanalysis, IPv6 security, and XML external entities attacks. Tim develops and maintains several open source forensics tools in addition to Bletchley, an application cryptanalysis toolkit.

Tim works to secure his customers’ environments through black box testing, code reviews, social engineering exercises, security training, and a variety of other services. Tim earned his computer science degrees from Harvey Mudd College and Northeastern University and currently resides in Portland, Oregon where he leads the local OWASP chapter.”

-

Managed by the official OWASP Media Project https://www.owasp.org/index.php/OWASP_Media_Project

More from this channel