Talks·46 min
John Walker
Walks through open source tools that apply DevOps practices to identity controls in AWS and Azure environments.
cloudidentityopen-source+2
October 2024 · Austin, TX, USA
LASCON 2024
1 session · 42 talks
Sessions at this event
All LASCON 2024 talks
1–24 of 42 talks
Talks·51 min
Andy Lewis
Walks through the UA-Parser npm compromise and what it reveals about risk in open-source dependencies.
supply-chainopen-sourcetrust+2
Talks·42 min
Rob Mixer
Explains how AI models pulled from public hubs can carry hidden code, and how teams can reduce that risk.
aimachine-learningsupply-chain+2
Talks·25 min
Nuray Baltaci Akhuseyinoglu
Presents a consolidated set of threat modeling questions for AI and ML applications, distilled from fourteen existing frameworks.
aithreatrisk+2
Talks·43 min
Himanshu Dwivedi · Elena
Presents ten low-effort API security checks that a small team could run within about half an hour a week.
appsecsecurity-operationsdefensive-security+2
Talks·47 min
Lucas Duarte · Anton Aleksandrov
Shows how a serverless pipeline uses Amazon Bedrock to open pull requests that patch vulnerable container dependencies.
vulnerabilitiesaiautomation+2
Talks·50 min
Mano Paul
Surveys major AI attack classes from the OWASP ML and LLM Top 10, with a live adversarial-noise demo against an image classifier.
aimachine-learningowasp+3
Talks·50 min
Colin Bell · Rob Cuddy
Shares lessons from five seasons of podcast interviews on people, process and buy-in for DevSecOps.
lessons-learnedinterviewdevops+2
Talks·35 min
Petr Sidopulos
Explains how to tame CIS benchmark compliance scans across mixed OS versions and turn deviations into a documented baseline.
compliancewindowslinux+2
Talks·1 hr 3 min
Roger Thornton
Explains how venture capital works for security startups and which funding pitfalls founders should avoid.
innovationlessons-learnedmanagement+2
Talks·52 min
Mário Teixeira
Explains what changed in CVSS version 4 and where its scoring still falls short for prioritizing open source vulnerabilities.
vulnerabilitiesriskopen-source+2
Talks·45 min
Theresa Lanowitz
Presents survey data on barriers to cyber resilience, from budgeting and incident response to supply chain visibility.
riskincident-responsemanagement+2
Talks·51 min
Gabe Schuyler
Surveys the security risks AI adoption adds to cloud infrastructure, from exposed databases and leaked keys to malicious models.
aiinfrastructurecloud+2
Talks·49 min
Mark Spears
Walks through anonymized real-world DDoS attack data and shows how to analyze, stop and prevent such attacks.
attackincident-responseweb+2
Talks·49 min
Eitan Worcel
Shows where generative AI fails at fixing code vulnerabilities and how a hybrid approach can work more reliably.
aiappsecvulnerabilities+2
Talks·50 min
Karen Lu
Shows how an engineering organization makes threat modeling earlier, lighter and more scalable using security champions.
threatriskdevelopment+2
Talks·54 min
Akanksha Pathak
Shows startups how to secure their software supply chain using free tools, SBOMs, and low-cost vendor controls.
supply-chainopen-sourcevulnerabilities+2
Talks·50 min
HD Moore
Shows how short, sequential identifiers leak details about systems, people and networks, and how to reason from a few samples.
identitynetworkvulnerabilities+2
Talks·49 min
Matt Tesauro
Weighs whether ASPM is a genuinely new discipline and shows how to pull its useful ideas into an existing AppSec program.
appsecmanagementlessons-learned+2
Talks·35 min
Ankush Jain · Ankita Gupta
Shows how to catch broken authorization flaws in CI/CD pipelines using staging tests for IDOR, roles, permissions and plans.
appsecvulnerabilitiesdevops+3
Talks·43 min
Chris Lindsey
Surveys how AI tools could reshape AppSec workflows, from developer productivity to vulnerability prioritization and QA.
aiappsecdeveloper+2
Talks·38 min
Aaron Harrison
Shows how security coaches and shared team metrics can help development and security ship code together.
devopsapplicationteam+3
Talks·48 min
Abraham Aranguren
Walks through real flaws from public pentest reports across mobile, web, VPN, and cloud applications.
vulnerabilitiesmobileweb+3
Talks·43 min
Tanya Janca
Lays out three common AppSec program models, why they stall, and practical next steps to mature each one.
appsecapplicationmanagement+3