Communication Breakdown

Besides being a fantastic song from one of my all time favorite English rock bands, Led Zeppelin, today's blog title describes one of the things I have seen around Application Security and why stuff slips through the crack. Nothing surprises me more than to see a developer make assumptions about something and then come to the realization just before release that the stuff just doesn't work... Keep in mind, this 'just before release' should never occur if AppSec is plugged into the SDLC properly, but when an AppSec program is in its infancy, this is just one of many things to overcome.

Communication (or lack of) seems to be a problem in a lot of areas in business. If we would all just open up a bit and make sure we understand what is being told to us or communicate more clearly, ourselves, many of these problems would not exist in the first place.

It just amazes me that something so simple could be one of the biggest problems in industry today.

API 3rd Annual IT Security Conference

Besides getting to play a pimp and embarrass myself in front of the upper management of several oil and natural gas companies, it was very exciting for me to get to spend time talking with Jeremiah Grossman about Application Security. Having him go through explaining one of his most recent discoveries (Clickjacking) was eye opening. We were a little worried that the potential attendees would not be technical enough to appreciate the talk. Thank goodness, we were wrong. The questions started pouring in at the end about how to protect themselves, etc.

If you ever get a chance to hear Jeremiah speak, take the opportunity. You will not be disappointed.