https://rietta.com/learning/appsec/ Recent content in Application Security Learning Center on Rietta Cybersecurity Hugo -- gohugo.io en-us 1999-2026 Rietta Inc. All Rights Reserved. https://rietta.com/learning/appsec/whats-application-security/ Mon, 01 Jan 0001 00:00:00 +0000 https://rietta.com/learning/appsec/whats-application-security/ Application security is about making software resilient from attack by adversaries who already have access, not just keeping outsiders out. That distinction shapes everything else in this learning center: the goal isn’t a perimeter you defend once, it’s software that stays trustworthy even when an attacker gets a foothold. This has been core to how Rietta approaches software since the company’s earliest days running web hosting and infrastructure in 1999, security-adjacent work before application security had the name it does now. https://rietta.com/learning/appsec/patch-production-now-bsides-jackson/ Mon, 01 Jan 0001 00:00:00 +0000 https://rietta.com/learning/appsec/patch-production-now-bsides-jackson/ A conference talk on why timely patching of production systems is a non-negotiable part of application security, not a nice-to-have. Recorded at BSides Jackson on November 9, 2019. https://rietta.com/learning/appsec/practical-application-security-full-lecture/ Mon, 01 Jan 0001 00:00:00 +0000 https://rietta.com/learning/appsec/practical-application-security-full-lecture/ This is the complete hour-long lecture, pre-recorded for a hybrid delivery class. Everything else in this AppSec track is an excerpt or a quick take; this is the whole class. If your team wants to go further than watching, Rietta runs live, interactive workshops built around this same material, in person or remote, with breakout exercises so your developers actually practice threat modeling and secure development instead of just hearing about it. https://rietta.com/learning/appsec/what-is-a-cve/ Mon, 01 Jan 0001 00:00:00 +0000 https://rietta.com/learning/appsec/what-is-a-cve/ A quick explainer on what a CVE (Common Vulnerabilities and Exposures) is, and why staying current on them is a non-negotiable part of running a secure application. https://rietta.com/learning/appsec/hellaconf-securing-open-source-supply-chain/ Mon, 01 Jan 0001 00:00:00 +0000 https://rietta.com/learning/appsec/hellaconf-securing-open-source-supply-chain/ Popular app frameworks like Docker, Node.js, React, Ruby on Rails, and Grails all pull in thousands of dependencies, and developers routinely add dependencies that may be unsafe. This talk covers how malicious actors use open source libraries to attack applications, and a proactive dependency management approach to stop it. Recorded at HellaConf 2020. For the short version, see Third-Party Dependencies in the Software Supply Chain. https://rietta.com/learning/appsec/third-party-dependencies-software-supply-chain/ Mon, 01 Jan 0001 00:00:00 +0000 https://rietta.com/learning/appsec/third-party-dependencies-software-supply-chain/ A class excerpt on why every third-party dependency you pull into a project becomes part of your software supply chain, and part of your attack surface. Staying current on dependency CVEs isn’t optional busywork, it’s part of the job. https://rietta.com/learning/appsec/nist-800-63b-password-compliance/ Mon, 01 Jan 0001 00:00:00 +0000 https://rietta.com/learning/appsec/nist-800-63b-password-compliance/ A quick look at how an OWASP Application Security Verification Standard (ASVS) review helps confirm, and document, that an application’s password handling actually complies with NIST 800-63B — the federal digital identity guideline that governs password policy for anyone doing business with the U.S. government. https://rietta.com/learning/appsec/growing-up-infosec-policy-driven-organization/ Mon, 01 Jan 0001 00:00:00 +0000 https://rietta.com/learning/appsec/growing-up-infosec-policy-driven-organization/ How an organization grows up from ad hoc security practices into a real, policy-driven information security program. Recorded at BSides Nashville 2018, filmed by Adrian Crenshaw (Irongeek). https://rietta.com/learning/appsec/cia-triad-vs-ciana/ Mon, 01 Jan 0001 00:00:00 +0000 https://rietta.com/learning/appsec/cia-triad-vs-ciana/ The classic CIA Triad, Confidentiality, Integrity, and Availability, is a good starting point, but it’s incomplete for how modern, internet-connected systems actually get attacked and defended. Non-Repudiation and Authentication earn their own pillars in the fuller CIANA model, because so much of modern risk lives exactly there. Read more in The Five Pillars of Information Security (And Why We Audit Accessibility). https://rietta.com/learning/appsec/defending-against-data-breaches-ruby-developer/ Mon, 01 Jan 0001 00:00:00 +0000 https://rietta.com/learning/appsec/defending-against-data-breaches-ruby-developer/ A 20 minute conference talk given at Rocky Mountain Ruby 2015, recorded by Confreaks, on defending against data breaches as a practicing Ruby developer. https://rietta.com/learning/appsec/five-pillars-of-information-assurance/ Mon, 01 Jan 0001 00:00:00 +0000 https://rietta.com/learning/appsec/five-pillars-of-information-assurance/ In this short video, I summarize the five pillars of information assurance, also called the pillars of information security or the pillars of cybersecurity. It’s been my teaching framework for a long time, and it helps show where every discipline in a comprehensive security practice fits into one cohesive whole. For the fuller picture, start with Practical Application Security for Developers, our free hour-long course. And for how this connects to web accessibility, hint: think about what Availability really means in full context, in The Five Pillars of Information Security (And Why We Audit Accessibility). https://rietta.com/learning/appsec/what-information-do-i-need-to-secure/ Mon, 01 Jan 0001 00:00:00 +0000 https://rietta.com/learning/appsec/what-information-do-i-need-to-secure/ Question: What information do we need to keep secure? Answer: It’s about classifying the information. Read more on Frank’s blog post on this: Commercial Information Security Classification System. https://rietta.com/learning/appsec/is-ruby-on-rails-secure/ Mon, 01 Jan 0001 00:00:00 +0000 https://rietta.com/learning/appsec/is-ruby-on-rails-secure/ Question: Is Ruby on Rails secure? What if I add SSL? Answer: Security is not an on/off switch. You need to ask three questions whenever you’re trying to determine the appropriate security level for anything: Secure against what? What is the worst thing that can happen? Compared to what alternative? There is no secure switch to make all the risks go away. Security is a process that includes every aspect of the business model, application development, and deployment management practices, not a single magic setting. https://rietta.com/learning/appsec/reducing-vulnerability-surface-area/ Mon, 01 Jan 0001 00:00:00 +0000 https://rietta.com/learning/appsec/reducing-vulnerability-surface-area/ Question: How do you eliminate surface area at multiple levels? How do you balance the need for security with the need for usability? Answer: It’s best to remove sensitive information from the business model entirely where you can. Where you can’t, use technical controls to segment the sensitive data as part of a defense-in-depth strategy. https://rietta.com/learning/appsec/does-a-uuid-make-a-secure-api-token/ Mon, 01 Jan 0001 00:00:00 +0000 https://rietta.com/learning/appsec/does-a-uuid-make-a-secure-api-token/ So you need to implement an API token for a mobile application to access your backend server. A common practice among Ruby on Rails or Sinatra developers is to use a UUID. But is this a good idea? Is it secure enough? Can you just store it in plaintext in the database? No. Not for the same reasons you should never store passwords in plaintext in the database. But UUIDs do make great random usernames, and following the same pattern you’d use for securely hashing passwords, you can build a very secure API token system for your application. https://rietta.com/learning/appsec/gdpr-on-rails/ Mon, 01 Jan 0001 00:00:00 +0000 https://rietta.com/learning/appsec/gdpr-on-rails/ A working Rubyist’s briefing on designing for security, privacy, and consent under GDPR. Recorded at the May 2018 Nash.rb meeting at the Ramsey Solutions Conference Center in Franklin, Tennessee. https://rietta.com/learning/appsec/patching-rails-critical-cve-atlrug/ Mon, 01 Jan 0001 00:00:00 +0000 https://rietta.com/learning/appsec/patching-rails-critical-cve-atlrug/ A walkthrough of efficiently patching a Ruby on Rails application when a critical CVE drops, using CVE-2022-32224 (an ActiveRecord vulnerability affecting YAML-serialized fields) as the working example. The principles apply broadly, well beyond that one CVE. Recorded at the monthly Atlanta Ruby Users’ Group (ATLRUG) meeting on July 13, 2022. https://rietta.com/learning/appsec/ksu-breach-prevention-for-developers/ Mon, 01 Jan 0001 00:00:00 +0000 https://rietta.com/learning/appsec/ksu-breach-prevention-for-developers/ As an information security professional, it’s critical to know something about how custom web applications are developed and the impact that has on application security. This guest lecture, given to infosec students and professionals at Kennesaw State University, covers what it takes to build security into a web application hosted in the cloud. Since security cannot be bolted on at the end, it walks through the tools available to include security as part of the development process, including user stories, abuser stories, and test-driven development that includes security tests. https://rietta.com/learning/appsec/atlrug-2014-data-breach-prevention/ Mon, 01 Jan 0001 00:00:00 +0000 https://rietta.com/learning/appsec/atlrug-2014-data-breach-prevention/ Whenever you’re considering the security of a system, ask three questions: secure against what, what’s the worst thing that can happen, and compared to what alternative? A full-length talk on how a Ruby on Rails developer can help prevent a data breach, recorded at the Atlanta Ruby Users’ Group (ATLRUG) in 2014. Slides are available on Speaker Deck.