Conquering Castle Envy

Jeff Williams, who wrote the first OWASP Top 10 and the WebGoat training project, opens with a frustration: application security has changed little in about 25 years. He argues the field still leans on a castle model, where teams imagine threats, build defenses, test once and move to operations. Across standards and industry statistics he sees growing backlogs, weak relationships between development and security, and little knowledge of what happens in production.

The middle of the talk compares the application layer to a living city rather than a fortress. He draws a parallel with application performance monitoring, which moved into production because performance problems only appear with real users and data, and suggests security testing needs the same runtime context. He proposes a graph that links business data, assets, infrastructure, software and observed attack activity, fed by sensors at runtime, so threat modeling, penetration testing and compliance can reuse shared information. He also argues that CVSS scores assume the worst, and that many open source libraries in production never load.

The takeaway is to instrument production, prioritize the vulnerabilities attackers are actually targeting and that connect to sensitive assets, and share that context across teams. He works through a budget example in which focusing on the small share of real issues cuts both cost and remediation time sharply.