Netflix Product & Application Security Panel

Note: This is a recording of a virtual 'after hours' event that took place during USENIX Enigma 2021 on February 2, 2021.
Panelists: Astha Singhal, Director of Application Security at Netflix, Nitzan Blouin, Product Security Manager at Spotify, Mike Shema, Product Security Lead at Square and Arkadiy Tetelman, Head of Application and Infrastructure Security at Chime
Hosts: Julia Knecht & Patrick Thomas, Application Security Partners at Netflix
Product and Application Security is a constantly-evolving discipline in which we work to enable the business to release software that is secure and worthy of trust for our customers. This is a huge scope, and different companies have varying approaches to establishing programs whose mission is to secure software. In this panel-gameshow session with Product and Application Security Leaders, we interpret the results of a survey, covering interesting data points about product and application security programs at various companies. We touch on important questions; 'What activities do we spend time on that are overrated and underrated?', 'How do you appropriately scope and focus a team to solve the most impactful problems?', and 'What up and coming tech are you looking forward to using to improve security in 2021?'

[@RichBarilla]

A WAF is not overrated, so he's wrong. A WAF with exploit-specific detection is 100% necessary to BLOCK what is KNOWN in the wild. Secondly, the # of secure coding bugs continues to increase over the past 20 years, therefore the NEED for WAF is increasing since secure code bugs increases. The gentleman has no idea what he's talking about -- I'm tired of quasi-experienced ITSec folks forming opinions publicly to the masses without being checked for integrity, common sense, logic, knowledge, experience, and reality. IF secure coding was getting better (and NOT EXPANDING exponentially) then you can make the claim that a WAF is overrated or unnecessary. Also, for production code, fixing secure coding bugs is exponentially more expensive $$$$ than deploying a signature-OWASP-based WAF. An open source WAF which costs almost nothing is exponentially more valuable than secure coding. Web App developers are lucky and used to having a WAF protecting them. Hiding a vulnerability being a negative WAF attribute is just a silly statement... barilla.ink or menschrisk.com