The Elephant In AppSec Conference Schedule

As cloud-native architectures grow more complex, the limitations of CNAPPs are becoming more obvious. Although CNAPPs promise comprehensive security through a unified platform, they often fall short, especially in delivering detailed protections needed for environments like Kubernetes. This talk will look at the future of security beyond CNAPPs, suggesting that specialized point solutions can be more effective than all-in-one platforms. I'll dive into the key shortcomings of CNAPPs, particularly in runtime protection and developer integration, and show how in some cases targeted solutions can provide stronger, more adaptable security.

Feeling uneasy about AI taking over cybersecurity, or are you already relying on it too much? AI's promises sound incredible, but how can we really tell if it's living up to the hype and measure its real impact? In this expert panel, you'll hear from security, technical, and product leaders, each bringing a unique viewpoint to the table. They’ll tackle the challenges of evaluating AI performance in cybersecurity tools, discuss the metrics that matter, and share real-world successes and failures. Join us for a lively discussion on whether AI is truly enhancing application security

Let’s face it PAM (AKA privileged access management) was built for servers from circa 20 years ago. The cloud-native ecosystem has evolved significantly since its early days, in tandem with the increased sophistication of modern threat actors and the exploit landscape.  This begs the question, why are organizations still protecting their most sensitive assets and accounts with access control that is optimized for legacy systems?  In this talk we’ll walk through the evolution from on-prem to the modern cloud, focusing on the four core elements that impact your security posture when it comes to privileged cloud resources: connectivity, authentication, fine-grained authorization (FGA), and visibility.  

We’ll demonstrate through real examples where PAM breaks down and just-in-time access comes in to level up your cloud security. We’ll wrap up with better practices when it comes to access control for modern cloud environments. You’ll come away from this session with practical ways to de-escalate unnecessary privileges, lower costs, reduce man-in-the-middle (MITM) as well as single points of failure, and hopefully provide you with some peace of mind when it comes to your cloud security.

"DAST is dead." It’s a phrase that’s been making the rounds on social media, but what if 2024 is the year it becomes reality? For the past decade, DAST has been a cornerstone of application security testing, but it’s time to step aside for the next generation—Business Logic Security Testing. As the industry evolves, so do the challenges, and today’s most critical security issues go beyond what traditional tools can detect. Many security engineers remain skeptical that any tool can truly understand the business logic of applications. But why is mastering business logic security more important than ever? In this talk, I’ll explore exactly why—and how it can reshape your approach to application security.

For the past decade, API security has centered around traffic monitoring, relying on deep integrations with applications, gateways, and reverse proxies. This approach overlooked a critical issue: API development within most enterprises is decentralized, leaving security teams unaware of how many APIs they need to secure, where those APIs are deployed, or their business criticality. As a result, adoption has been slow, coverage incomplete, and investments in API security difficult to gauge.

In this talk, I’ll explore why traditional approaches, such as API-centric DAST and runtime API protection, have failed to scale and deliver the expected results. And how shifting our overall AppSec strategy might improve the way enterprises secure their APIs.

Many organizations invest heavily in security tools that end up being costly and not useful. In this talk, we’ll explore why most security tools fail to deliver on their promises, focusing on issues like misalignment with real needs, poor integration, and ineffective utilization.

We’ll dissect common pitfalls that lead to wasted resources and reduced security effectiveness, using real-world examples to illustrate these failures. You’ll learn why your current tools might not be working as expected and how to address these challenges.

Finally, we’ll provide practical strategies to optimize your security tools, ensuring they integrate well into your existing systems and deliver tangible value. Discover how to turn these investments into powerful components of your security strategy.

Buckle up for some hot takes as we dive into the frustratingly unclear world of software supply chain security. We’ll call out the tools that can’t properly identify components and spotlight ecosystems getting little to no love (looking at you, C/C++). Expect a deep dive into the glaring gaps in security disclosures for open-source software and the dismal rates of transparency across the board. We’ll also break down the confusing, overly complex, and completely unenforced vulnerability reporting processes that are leaving everyone exposed. If you thought supply chain security was under control, think again.

Our SAST tools cannot detect critical bugs. Instead they generate a lot of noise and waste our time. We have a gut feeling that the observations stated above are correct. But do we know exactly how bad the situation is? The SAST tools and the industry need to start talking about metrics that they have conveniently bypassed so far. Some suggested metrics are as follows: an account of false negatives and false positives against benchmark data, the percentage of false warnings on real applications, the percentage of reports that lead to an actionable security issue fix, the effectiveness of remediation advices provided now, etc. In this talk, we will explore these metrics for leading SAST tools. We will identify the gaps that should be filled by SAST 2.0. SAST 1.0 is dead, Long Live SAST 2.0 !

AI is now being used to enhance AppSec. It is a powerful tool that is used for data analytics. While innovators are quick to adopt AI for its benefits, many tend to overlook the security concerns that AI brings. Unfortunately, discussions around AI security are often too high level or complex for wider industry understanding. I’m here to explain why that is - and how we can change it.

In this presentation, you will learn about why more importance needs to be placed on securing AI in AppSec and strategies the audience can use to secure AI.