How to improve relations between developers and security teams and boost application security
Chris Wysopal shared a history lesson about the evolution of application security and advice on how to make all apps more secure.
Veracode CTO Chris Wysopal shared the highlights of his career in application security during an OWASP event, including his 1998 testimony to Congress as a member of the hacking collective The L0ft.
Image: Chris Wysopal
In December 1996, application security expert Chris Wysopal published his first vulnerability report. He found that data could be edited or deleted in Lotus Domino 1.5 if permissions were not set properly or URLs were edited. That security risk — broken access control — is the number one risk on OWASP’s 2021 Top 10 list of application security risks.
“We know about this problem really well and knowledge about the problem isn’t solving the problem,” he said.
Wysopal, who is Veracode’s CTO and co-founder shared a short history of his time as an application security researcher, from his time with The L0ft hacker collective to testifying in front of Congress to doing security consulting with Microsoft in the early 2000s. Wysopal spoke during a keynote at OWASP’s 20th anniversary event, a free, live, 24-hour event held on Friday.
Wysopal said that he started out as an outsider in the tech world, which gave him a unique perspective to call out problems that software engineers, company leaders and government officials did not see. Over the last 25 years appsec researchers have moved from critics standing on the outside looking in to professional colleagues working with software engineers to improve security.
SEE: How DevOps teams are taking on a more pivotal role
“As William Gibson said, ‘The future is unevenly distributed, and I think we can learn from the past and learn from those already living in the future,” he said.
He shared advice on how to build closer working relationships among developers and security experts as well as how the appsec profession has evolved over the years.
Building relationships to improve security
Wysopal said he sees the latest…
