Realize new opportunities with Fortinet and Azure Integrations | StudioFP122

[Music] hey everyone thank you so much for joining us again I'm here with my good friend Aiden Walden from fortunet and we have been having behind the scenes a fascinating conversation that we're actually going to let you listen in on now so Aiden thank you so much for being here thank you Donna okay so we were talking backstage about how devs like myself have absolutely no idea how to make good secure apps right unless we've gotten bit but once or twice which I have but in this era of AI it feels like we've completely forgotten the basics right so what are some things that app team should remember just from a general point of view about security well in terms of what they should remember that AI is an application whether it's a a third party model or it's your model it's an augmented model uh you have to protect that like an in any application and often times or that's typically in API end point right and when you talk about the biggest threat to security um exposed apis especially in Cloud where they predominate U is a real security risk and that's something that's very difficult to manage at scale um and so I think that if you look at that as an attack Vector the open API uh especially at the the risk of you know your model and your data uh that becomes hugely critical right especially if we're building these apps that are have like exponential reach yes yeah and yeah that that is what I was super worried about as we're building these AI apps we ad Dev like myself would have to go seek advice because it's not second nature it's not obvious how to do this but I hear you all at fortnet are trying to make this easier can you tell us a little bit about the work you all are doing absolutely at foret we've taken a full life cycle view on security that starts at the time the application is being factored um and so at at build we been talking a lot about source code security uh Dynamic application testing you know providing all of that information that doesn't put additional burden on the application developer but is a very low level of effort to actually give them a a net return time on or investment on their time so they they can work on the things that they need to work on and security just becomes very natural in the workflow U but then once we minimize the attack suro I I think it's very important to also take that into the production environment so that application lives and becomes vulnerable albeit more secure in production but we want to take what we learn and feed that back Upstream to the application developers in a way that is very easy for them to understand easy for them to iterate yeah and then we can that's where we can link that full life cycle of security um and that's very specific uh or that really addresses the problem of that API security need because typically or historically we've been very loose about how we protect those points because the schema uh you don't want to impact user experience and so we were very loose relative to the schema but now using machine learning we can get very very narrow on what that security policy is I like that because you're talking about how we can think about security at the design phase y but also once you're in production because we have to keep validating and testing absolutely and as we find issues we can actually design better yes and and the testing essentially is with every user interaction that occurs that's exactly it so it's not just shift left it's keep an eye on right right while shifting left and use that data to shift left I like that I like the way you put that yeah okay so what are some things that devs like myself can be doing as part of just our development process uh I think it's being uh just having a mindset for security um it's uh understanding uh what the uh what the attack surface exposure is of your application which is it's harder to do than it is to say um and so I think that's where good tooling and good organizational workflow is like we want to really incorporate those uh different personas into a unified workflow you have your security practitioners who are not developers and developers who don't need to spend their time in the security domain so much but they have to work together right and bringing them together into a common workflow where information is presented to each in a very contextual way and the framework that they need to understand it I think just facilitates a a a better overall delivery uh lower risk low uh at the least amount of least cost I love that because you're talking about the Old School fusion teams term which is bring together people from different sorts of disciplines to solve a problem yes I love that so I hear you all have a cool demo tomorrow where you get Hands-On with the tools and show us how to use them absolutely thank you for letting me plug it so the uh tomorrow at 900 a.m. we're going to be doing an extended demo on how to secure your application development um demo theater 2 absolutely okay 9:00 a.m. demo theater 2 devs and security people go there okay demo theater 2 you don't want to miss it okay I'll see you there e for