Why App Sec Matters

Jeff's Key Point: All software has bugs. Some bugs are just annoying, but others are Vulnerabilities that let hackers in.

Shift Left

Most bugs are created during the coding phase. If we find them during coding, they are cheap to fix. If we wait until the app is released, it can be 640 times more expensive to repair.

Baking in Security

From "Bolt-on" to "Built-in"

In the past, security was checked at the very end. Today, we use DevSecOps. This means security is integrated into every single step of building the software—from the first plan to the final release.

SBOM (The Ingredients List)

Just like a food label, a Software Bill of Materials lists every piece of code used to build an app. If a specific ingredient (library) is found to be dangerous later, the company knows exactly where to fix it.

SAST vs DAST

How do we find holes in the software automatically?

SAST (Static Testing): Looks at the code while it's sitting still. It's like a proofreader checking a book for typos before it's printed.
DAST (Dynamic Testing): Tests the app while it's running. It's like a test-driver taking a car on the road to see if the brakes fail at high speed.

Modern architects use both!

The App Sec Glossary

SDLC: Software Development Life Cycle. The step-by-step process of creating software.

Vulnerability: A specific bug that can be exploited by an attacker to gain unauthorized access.

Buffer Overflow: An error where too much data is sent to a small space in memory, causing the app to crash or execute malicious commands.

OWASP: A global group that creates the standard list of the "Top 10" most dangerous software mistakes to avoid.

Intellectual Property (IP): The "Secret Sauce" or private ideas of a company. Chatbots can accidentally leak this if developers aren't careful.