You know that it’s a wild and dangerous world out there on the Internet. You don’t need to be convinced that your application needs to be secured against intruders, hackers, bots, and worms. You’ve vaguely heard of XSS, CSRF, Authc, Authz, and the rest of the AppSec alphabet soup, but you’re not sure how to structure your application, what controls you need, or how to make sure you’re making the right investments of time and money to efficiently minimize risks.

This session will present some patterns and anti-patterns in web application architecture and process. We’ll talk about how to identify the parts of your application that require the most attention and which parts of your SDLC need the most security TLC.

Examples will be mostly in Java and JavaScript, but the ideas will be largely language-agnostic, so attendees will not need to be experts in either. This will be a technical talk, but appropriate to both programmers in the trenches and the managers who love them.