Application Security Learning Center

As a developer, you can prevent a data breach. Not by hoping you got security right, but by proving it: writing a failing test before the fix, writing abuser stories alongside user stories, and treating every security requirement the same way you’d treat any other one, as something that either passes or fails.

This track holds that idea in a lot of different shapes: a 60-second explainer, a full hour-long class, and conference talks recorded across the better part of a decade, on everything from patching a critical CVE under pressure to designing for GDPR to growing a real, policy-driven security program. Start wherever fits the five minutes you actually have.

Want more of this in your inbox instead of just on video? Subscribe to Rietta on Security, a low-volume newsletter on policy and technical trends in web application security.

Start Here

Frank Rietta speaking to camera with a monitor behind him, next to on-screen text reading "Application Security is about making software resilient from attack by adversaries with access."

What Is Application Security?

What application security actually means, and how Rietta's audits and secure development services keep software resilient even after an attacker gets in.

The Full Lecture

Presentation slide titled "Security Properties (The 5 Pillars of Infosec)" showing five tiles labeled C, I, A, N, A for Confidentiality, Integrity, Availability, Non-Repudiation, and Authentication, with Frank Rietta presenting in a webcam window.

Practical Application Security for Developers

The complete hour-long lecture on practical application security for developers, pre-recorded for a hybrid delivery class.

Quick Takes

Frank Rietta smiling in a Rietta.com Cybersecurity polo shirt, with title text "Rietta on Cybersecurity Presents: What is a C.V.E. in Software Security!?"

What is a CVE in Software Security?

A quick explainer on what a CVE (Common Vulnerabilities and Exposures) actually is, and why tracking them matters for keeping software secure.

Frank Rietta speaking into a microphone, with on-screen text "3rd Party Dependencies in Software."

Third-Party Dependencies in the Software Supply Chain

A class excerpt on why every third-party dependency you add to a project also becomes part of your attack surface, and how to manage that risk.

Frank Rietta speaking into a microphone, with on-screen text "Achieve NIST 800-63b Password Verifier Standard via OWASP ASVS!"

Archiving Federal NIST Password Compliance via OWASP ASVS Review

A quick look at how an OWASP ASVS review helps confirm and document password-handling compliance with NIST 800-63B.

Frank Rietta in a Rietta.com polo shirt, with on-screen text "The CIA Triad is Insufficient!"

CIA Triad is Insufficient to Understand Web Application Risk, Use CIANA Instead

Why the classic CIA Triad falls short for modern web applications, and why Non-Repudiation and Authentication earn their own pillars in the CIANA model.

Frank Rietta, in a Rietta.com/Security polo shirt, with on-screen text "The Five Pillars of Information Assurance."

The Five Pillars of Information Assurance in 60 Seconds

Frank Rietta summarizes the five pillars of information assurance, the framework tying every security discipline into one cohesive whole.

Public Presentations

Frank Rietta presenting on a dark stage at a podium, with a projected slide reading "All security depends on software security."

Patch Production Now!

A conference talk on why timely patching of production systems is a non-negotiable part of application security, recorded at BSides Jackson.

Securing the Open Source Software Supply Chain

How malicious actors use open source libraries to attack applications, and a proactive approach to dependency management. Recorded at HellaConf 2020.

Presentation slide quoting Steve Blank, "A Startup is Not a Small Version of a Big Company," with Frank Rietta presenting at BSides Nashville in a corner video window.

Growing Up to Be an Infosec Policy-Driven Organization

How an organization matures from ad hoc security practices into a real, policy-driven information security program. Recorded at BSides Nashville 2018.

Defending Against Data Breaches, as a Practicing Ruby Developer

A 20 minute conference talk given at Rocky Mountain Ruby 2015 on defending against data breaches from the perspective of a practicing Ruby developer.

Frank Rietta presenting to colleagues around a conference table, with a screen behind him showing a "Commercial Information Classifications" slide listing five sensitivity levels.

What Information Do I Need to Secure?

An exercise in commercial information classification: figuring out which information actually needs to be kept secure, and why.

Frank Rietta standing beside a projector screen reading "Is XYZ secure? Ask three questions: secure against what, what's the worst thing that can happen, compared to what alternative."

Is Ruby on Rails Secure?

Security is not an on/off switch. Three questions to ask whenever you're evaluating the security of any framework or application.

Frank Rietta presenting beside a slide titled "Reducing Surface Area while Protecting Usability," listing bullet points on changing the business process, countermeasures, and limiting access.

Reducing an App's Vulnerability Surface Area While Maintaining Usability

How to eliminate vulnerability surface area at multiple levels while balancing the need for security against the need for usability.

Slide showing a UUID being stripped of dashes and combined with a long randomly generated password, with a photo of Frank Rietta presenting.

Does a UUID Make a Secure API Token?

Whether a UUID is a good, secure choice for a mobile app's API token, and how to build a secure token system if not.

GDPR on Rails: Designing for Security, Privacy, and Consent

A working Rubyist's briefing on designing Ruby on Rails applications for GDPR: security, privacy, and consent.

How to Efficiently Patch a Ruby on Rails Application When a Critical CVE Drops

A walkthrough of efficiently patching a Ruby on Rails application when a critical CVE drops, using a real ActiveRecord CVE as the working example.

A Eurasian eagle-owl in flight, wings fully spread, photographed head-on against a grassy background.

Breach Prevention for Developers

A guest lecture at Kennesaw State University on building security into web application development, for infosec students and professionals.

How a Ruby/Rails Developer Can Help Prevent a Data Breach

A full-length talk on how a Ruby on Rails developer can help prevent a data breach, recorded at the Atlanta Ruby Users' Group in 2014.