Common Mistakes with Software Security

---

What coverage does application penetration testing provide? What about architecture analysis or static analysis? How much security testing is enough? This talk will present essential security concepts and draw a distinction between the different options available through examples.
Participants will learn, through interactive discussion some common misconceptions and how to build or raise the level of a software security program. Participants will learn the essentials, and how to avoid some common pitfalls, of building a program that is tailored for each application and yet includes appropriate risk management at the line of business or enterprise level.

---

---

---

---

Andres Cools is a Managing Principal at Cigital, with over 15 years of experience in software & information security. Mr. Cools has delivered engagements in Governance, Risk & Compliance, Application and Network Threat and Vulnerability, Managed Security Services, Training, Products, Forensic and Incident Response, building out Software Security Groups, Building Security in Maturity Model, Threat Modeling, Architecture Reviews and Risk Profiling. As a consultant, Mr. Cools has provided strategic direction and services to many of the world's largest multinational corporations. Mr. Cools holds a BA in Business, with an emphasis in International Economics from Kennesaw State University.

---