BrianSletten

While people are fixating on the threat AI brings to cybersecurity as a discipline, there’s the considerably more pedestrian but crucial perspective of securing these systems. The role of the CISO is expanding beyond security practices to include risk management, compliance, and more and these role expansions will cascade through the organization. Agentic systems collapse traditional boundaries between user, system, and adversary. Not only do they introduce new risks, they challenge foundational assumptions in security engineering. Identity and authorization grants are fluid based upon contextual composition, behavior becomes non-deterministic, and threat models become continuous, not static. What are the risks, challenges, and opportunities that are unleashed at the intersection of security postures, agents with agency, ambient authority, context-specific interactions, and engineering discipline? How does one grow this capability in an organization and how does one align their career in this direction.

Security problems empirically fall into two categories: bugs and flaws. Roughly half of the problems we encounter in the wild are bugs and about half are design flaws. A significant number of the bugs can be found through automated testing tools which frees you up to focus on the more pernicious design issues. Even in the time of AI, there's a discussion to be had.  In addition to detecting the presence of common bugs as we have done with static analysis for years, however, we can also imagine automating the application of corrective refactoring. In this talk, I will discuss using OpenRewrite and the Moderne cli to fix common security issues and keep them from coming back.  

Security problems empirically fall into two categories: bugs and flaws. Roughly half of the problems we encounter in the wild are bugs and about half are design flaws. A significant number of the bugs can be found through automated testing tools which frees you up to focus on the more pernicious design issues. Even in the time of AI, there's a discussion to be had.  In addition to detecting the presence of common bugs as we have done with static analysis for years, however, we can also imagine automating the application of corrective refactoring. In this talk, I will discuss using OpenRewrite and the Moderne cli to fix common security issues and keep them from coming back.  

The typical technologist has a fairly straightforward perspective about the use of resources in modern software systems. They understand the concept of stable identifiers and what some of the HTTP verbs are intended for based upon experiences with the Web.

Retrieval Augmented Generation (RAG) systems have emerged to provide guardrails to spirited non-determinism of unfettered Large Language Models. While useful, they are clearly not enough even in the more advanced configurations of query rewriting, domain/chunk-size alignment, and re-ranking activities. At the edge of energetic AI wave is a new form of token generation involving concepts and actions that will take things even further.

Retrieval Augmented Generation (RAG) systems have emerged to provide guardrails to spirited non-determinism of unfettered Large Language Models. While useful, they are clearly not enough even in the more advanced configurations of query rewriting, domain/chunk-size alignment, and re-ranking activities. At the edge of energetic AI wave is a new form of token generation involving concepts and actions that will take things even further.

There's a clear need for security in the software systems that we build. The problem for most organizations is that they don't want to spend any money on it. Even if they did, they often have no idea how much to spend. No particular initiative is likely to imbue your system with "security", but a strong, deep defensive approach is likely to give you a fighting chance of getting it right. Web Security as applied to APIs in particular are an important part of the plan. In this workshop, we'll show you how approaches to defining "enough" as well as concrete techniques to employ incrementally in your designs. In this workshop, we will pick a hands on framework for implementation, but the ideas will generally be standards-based and transcend technology choice so you should have a strategy for mapping the ideas into your own systems.

There's a clear need for security in the software systems that we build. The problem for most organizations is that they don't want to spend any money on it. Even if they did, they often have no idea how much to spend. No particular initiative is likely to imbue your system with "security", but a strong, deep defensive approach is likely to give you a fighting chance of getting it right. Web Security as applied to APIs in particular are an important part of the plan. In this workshop, we'll show you how approaches to defining "enough" as well as concrete techniques to employ incrementally in your designs. In this workshop, we will pick a hands on framework for implementation, but the ideas will generally be standards-based and transcend technology choice so you should have a strategy for mapping the ideas into your own systems.