Version with notes: https://speakerdeck.com/oreoshake/twubhubbook-its-like-appsec-but-for-startups-with-notes

1. I T ’ S L I K E A P P S E C , B U T F O R S T A R T U P S
TWUBHUBOOK

2. Originally from the bay, Brent spends his time
doing all the fun things LA has to offer while he
longs for the days when he can move back home.
Finally has a twitter account.
a.k.a. @brentjo on GitHub @gsmbj on twitter
Brent Johnson
TROJAN. BOUNTY TRIAGE
EXPERT. BUSINESS LOGIC
FLAWS ARE HIS FRIEND.

3. I like dog.
Twitter: @ndm
Neil
“oreoshake”
Matatall
ASPIRING PARK RANGER.
DOES NOT LIKE COMPUTERS.

4. W H A T ’ S A T W U B H U B B O O K
Greenfield
In many disciplines a greenfield project is one that lacks constraints
imposed by prior work. The analogy is to that of construction on
greenfield land where there is no need to work within the constraints
of existing buildings or infrastructure - Wikipedia

5. W H A T ’ S A T W U B H U B B O O K C O N T ’ D
Young application
Think pre-pre-pre-pre-pre-IPO.

6. W H A T ’ S A T W U B H U B B O O K C O N T ’ D
Mature application

7. The Future: 2025
D A Y O N E O N T H E J O B
Oddly, the mannequin challenge is still even in
2025.

8. 2
4
| Agree on acceptable technology
| Always stay current
| Review architecture
| Code review culture

9. 4
| Agree on acceptable technology
| Always stay current
| Review architecture
| Code review culture

10. 4
| Agree on acceptable technology
| Always stay current
| Review architecture
| Code review culture

11. | Agree on acceptable technology
| Always stay current
| Review architecture
| Code review culture

12. B E I N T H E B U S I N E S S O F P R E V E N T I O N
SECURITY DOES NOT
HAVE TIME TO FIX
OR FIND BUGS

13. What have we
accomplished?

14. Building a healthy
culture
W E E K 2 O N T H E J O B

15. W E ’ R E H E R E T O S A Y
“ B E C A R E F U L ”
SECURITY IS NOT
HERE TO SAY
“NO”

16. Twubhubbook
hits its first
milestone
1,000,000 MAUS

17. What have we
accomplished?

18. The game has
changed,
strategies must
be updated.
PROCESSES MUST SCALE
CULTURE MUST STAY STRONG
FLEXIBILITY IS IMPORTANT

19. FOCUS ON LEARNING
“I TOLD YOU SO” IS FORBIDDEN
“The incident”

20. What have we
accomplished?

21. The security team
grows
D A Y ? ? ? O F ? ? ?
Mommy, wow! I’m a big kid now.

22. | FRAMEWORK HARDENING
2
4
3
1
| COLLAB WITH STANDARDS BODIES
| SHARED RESPONSIBILITY

23. The bug bounty
turns 3!
MORE BUGS, BIGGER BOUNTIES

24. HOLD ON FOR YOUR ASSES
PERHAPS TAKE UP MEDITATION
Pre-IPO

25. I HEARD YOU HAD TO WRITE A FIFO
CACHE IN COLLEGE — CAN YOU REVIEW
THIS MIPS CODE OUR CORE BUSINESS
OPS NOW DEPEND ON?
Stack Diversifies

26. Development
stack consolidates
DON’T BUDGE ON SECURE BY
DEFAULT, HARDEN THE
FRAMEWORK, DESIGN SERVICES
SECURELY.

27. TESTS FOR EVERYTHING. ROLES FOR
EVERYONE.
Beyond basic appsec

28. The IPO
engineer = Twubhubbook.appsec_team.first;
engineer.company = BayArea.startups.next;

29. “STARTING UP SECURITY” - RYAN MCGEEHAN
HTTPS://MEDIUM.COM/STARTING-UP-SECURITY
“THE SAAS CTO SECURITY CHECKLIST” - SQREEN
HTTP://CTO-SECURITY-CHECKLIST.SQREEN.IO/
Further Reading

30. KAILUA KONA, HAWAI’I
APRIL 2018
LOCOMOCOSEC.COM
@LOCOMOCOSEC
Loco Moco
Security
Conference