The Abridged History of Application Security

The talk opens with a 1967 classified United States government review that found software security lacking, then uses a 1938 codebreaking machine as an early example of a security testing tool. It moves through the 1990s and early 2000s, when a network analysis tool, the naming of SQL injection and cross-site scripting, Metasploit and early code review teams turned web testing into a mature discipline. Standards and guides from the OWASP community are presented as widely adopted by compliance teams and large software companies.

The middle section traces DevOps from a 2009 security testing program at Etsy, the first software bill of materials in 2010, and open-source orchestration and dependency scanning tools released in 2013 and 2015. The rise of threat modeling around 2020 and integrated scanning in code hosting platforms show security moving into development pipelines. The HTTPS section follows the origins of certificate authorities, the SSL Labs grading service, Let's Encrypt, TLS 1.3, and browsers defaulting to HTTPS. The password section covers a 1961 password file, a student who printed it, and the path from crypt and bcrypt to Argon2id.

The closing message is that progress is real even when daily triage feels fruitless. The speaker urges practitioners to update their libraries rather than relying on inventories alone, and notes strong demand for application security skills. The future of the field is presented as the ongoing work of the people doing it.