X
Enlarged Image
Back to blog

CISO Thoughts with David Lindner - April 29

By David Lindner, Chief Information Security Officer

May 3, 2022

Insight #1

"How do you measure risk between vulnerabilities in custom code vs vulnerabilities in third-party code? To determine the real risk, I strongly encourage developers to start utilizing other measuring tools such as the Exploit Prediction Scoring System (EPSS). The reality shows us that a CVSS of 9 for a custom code vulnerability is not always as risky as a CVSS of 9 in a third-party library vulnerability."
 

Insight #2

"I get asked a lot about prioritization of “features” over security requirements. I don’t like that question, because I believe every single feature released has some aspect of security that should be designed, added, modified, or removed. Once we understand security is a key stakeholder in every single feature, we realize that prioritization gets easier and will be based primarily on the team's availability to implement the new feature. Keep security involved at every stage."
 

Insight #3

"How many passwords have you forced yourself to remember? How many renditions of the same password (e.g. Password1, Password12, Password1!) are you using? A password manager will simplify your life and allow you to create and store passwords securely, and at the same time, you will never have to even know what those passwords are. Get yourself a password manager today."
 
 
 
 
Thought Leaders
David Lindner, Chief Information Security Officer

David Lindner, Chief Information Security Officer

David is an experienced application security professional with over 20 years in cybersecurity. In addition to serving as the chief information security officer, David leads the Contrast Labs team that is focused on analyzing threat intelligence to help enterprise clients develop more proactive approaches to their application security programs. Throughout his career, David has worked within multiple disciplines in the security field—from application development, to network architecture design and support, to IT security and consulting, to security training, to application security. Over the past decade, David has specialized in all things related to mobile applications and securing them. He has worked with many clients across industry sectors, including financial, government, automobile, healthcare, and retail. David is an active participant in numerous bug bounty programs.

Previous

Contrast Protect Blocks Spring4Shell | Contrast Security
Next

Contrast Scan now supports security testing for C# applications for .NET Web Forms