Look Who it Was Random video

How building a better hacker ... - Casey Ellis - OWASP AppSec California 2015

549 views · Published 7 May 2015 · 55:54 · Indexed 29 October 2026

Channel: OWASP Foundation · 2015 · Science & Technology

Watch on YouTube

AppSec California 2015 - Day 2, Track 3, Slot 3

Title

How building a better hacker accidentally built a better defender

Abstract

In the world of cybersecurity, there are two very important players. There are the builders. The folks who spend their time developing, writing source code for and launching products. And there are the breakers. The folks who spend their time testing for, identifying and fixing vulnerabilities in said code.

For the builder, development deadlines are constantly evolving and security measures tend to be seen as a hindrance, often slowing down the development process. And developers, by nature of their job descriptions, are responsible for contributing to products which make money. Without developers, there are no products, and thus no revenue stream.

For the builder/fixer, the challenge lies in making the builders take their concerns seriously. From the security team’s perspective, security efforts help minimize risk. Without security measures, there are increased chances of security flaws and breaches.

Where the problem lies is in the inability for the builders to not only speak the language of the breakers, but also to accurately understand their motivations; thereby creating a chasm in the way security is managed and executed.

But the real developer problem is that builders don’t believe in “The Bogeyman”. And the real security problem is that the breakers/fixers don’t have the time or resources to spend convincing developers that “The Bogeyman” is real. The Bogeyman, in this case, represents the very real possibility that your company will be hacked. After all, the most security aware a company will ever be is immediately after a breach.

In this presentation, Bugcrowd’s co-founder and CEO, Casey Ellis, will deep-dive into the hacker mentality, and how acknowledging the existence of The Bogeyman gets developers and security folks one step closer to implementing an effective security program. He’ll also discuss several security measures, outside the traditional penetration testing model, that can aid developers and security teams in leveling the playing field against potential threats.

The Bogeyman is real. But through acknowledgement, understanding and proactivity, you can be the hero in this cybersecurity story, not the victim.

Bio

Casey Ellis is the CEO and co-founder of Bugcrowd, the innovator in crowdsourced security testing for the enterprise. He has been in the information security industry for 14 years, working with clients from the very small to the very large, and has presented at Derbycon, Converge, SOURCE Conference, and the AISA National Summit. Before relocating from Sydney Australia to San Francisco with Bugcrowd, he founded White Label Security, a white-labelled penetration testing company; and served as the CSO of Scriptrock. A former penetration tester, he likes thinking like a bad guy without actually being one.”

-

Managed by the official OWASP Media Project https://www.owasp.org/index.php/OWASP_Media_Project

More from this channel