SecAppDev original
Security Signals - A framework to scale web security
Video and handoutsSecAppDev 2024
-
Abstract
Ensuring the security of web applications developed by many different engineers requires a solid understanding of security details and can be quite hard to scale. Thus, a web security team should also own the rollouts of security features. This requires a mindset shift, and high-quality metrics and tools to perform such changes.
In this session, we’ll explore Security Signals, a framework for collecting and processing aggregated and de-identified traffic logs across all Google web properties. Using the adoption of strict CSP as an example, we will take a closer look at how all components work.
Handouts available for this lecture
DownloadChapters
- Intro
- Introduction to Web Security
- Signal Collection Fundamentals
- Organic Security Signals
- Synthetic Security Signals
- Processing Signals
- Using Data to Improve Security
- Security Signals Framework Goals
- Use Case: Research and Remediations
- Use Case: Adoption of Mitigations
- Example: Cross-Site Request Forgery
- Security Signals Infrastructure
- Q & A
In-person course
Slawomir Goryczka taught at a previous edition of SecAppDev
SecAppDev is an immersive course in secure application development, running annually since 2005. World-renowned faculty from industry and academia deliver in-depth 90-minute lectures and full-day workshops in an intimate setting, typically in early June.
More about SecAppDev