The number an complexity of tools and techniques that make up good application security practices can be overwhelming. There are various application security testing tools, threat modeling processes, security requirements, as well as runtime security controls that need to be considered. This session will review the tools and practices that are essential to any application security program.

Attackers are targeting software development systems, open-source artifacts and DevOps pipelines to compromise software supply chains. In this Ask the Expert session, we will answer questions on emerging trends such as software bill of materials, hermetic pipelines and binary authorization to mitigate risks both for internally developed applications and externally procured software.

There are millions of open-source software projects in the world. Which ones are in your software? And what security, operational, and legal risks do they pose? Getting control and managing a myriad of risks requires information, process changed, and automated tools to spot and help remediate problems. In this session, we'll examine the various changes you should consider, along with the tools that can help in getting control.