David Lindner, Director, Application Security

AppSec Observer

Insight #1 It’s time to stop measuring your security organization success by the number of vulnerabilities you find. Security is a journey not a destination. Measure how quickly you are mitigating the vulnerabilities, mean time to remediate (MTTR), and measure how many of those vulnerabilities escape your processes, vulnerability escape ... Read More

Insight #1 Google is now defaulting to the use of passkeys for authentication. This is a huge step in increasing the strength of the authentication mechanism out of the box for users, and, at the same time, makes it easier to use ... Read More

Insight #1 AI voice cloning is a problem: It’s reportedly taken the top spot in scam trends, particularly targeting seniors. “My voice is my passport” can no longer be a thing.  ... Read More

Insight #1 For years — since 2018 — the National Institute of Standards and Technology (NIST) has said that password length trumps password complexity requirements. Now LastPass is forcing users into choosing a longer password. This is a brilliant move. More companies should force long passwords (12 characters or more) ... Read More

Insight #1 There will always be a balance in the psychological acceptability of any security controls put on users. This is especially important when developing a data loss prevention (DLP) strategy for your organization ... Read More

Insight #1 Software Bills of Materials (SBOMs) are nothing more than a data point for determining risk. They shouldn’t be treated as gospel ... Read More

Insight #1  Prompt injection is becoming a serious concern for those using current AI technologies. When using AI, make sure you have a way to at least detect these injection attempts if not block them ... Read More

Insight #1   There will never be an environment that is totally, 100% secure — at least, not one that provides any functionality. With that in mind, examine what security control layers you can and should add to get it as close as possible ... Read More

Insight #1 When looking at bringing in new security products it’s imperative to clearly outline your goals, which should always include total cost of ownership (TCO) ... Read More

Insight #1 As an industry we need to move away from CVSS base score as the risk measuring stick. It doesn’t work and is extremely broken ... Read More