Save $400 on InfoSec Training at SANS New York City Summer 2018. Ends Tomorrow!


To attend this webcast, login to your SANS Account or create your Account.

Protecting Third Party Applications with RASP

  • Thursday, July 30th, 2015 at 1:00 PM EDT (17:00:00 UTC)
  • Eric Johnson and Cindy Blake
This webcast has been archived. You can view the webcast presentation and download the slides by logging into your SANS Portal Account or creating an Account. Click the Register Now button after you have logged in to view the Webcast.


  • Hewlett Packard

You can now attend the webcast using your mobile device!


Why are so many threats against applications succeeding? Finding a software vulnerability is only part of the problem. Reused open source code and third party applications pose new challenges because you cant fix vulnerabilities for codes you dont have access to.

In this webcast, SANS application security expert Eric Johnson looks at the application security landscape, and provides perspective on the following questions:

  • What percentage of applications is custom built versus commercial off-the-shelf software?
  • What types of applications are of most concern (hint: .NET and Java apps)?
  • What threats are getting through to applications?
  • Who do enterprises think is responsible for application security?
  • What is the average time to repair vulnerabilities in applications?
  • How can you speed up detection and repair of application vulnerabilities?
  • How can you block application-based attacks with confidence?

Because it runs in the application, RASP (Run-Time Application Self Protection) is an emerging technology that can help protect applications against unknown threats and protect against vulnerabilities while a patch becomes available. This technology will also be discussed.

Click Here for the associated Infographic.

Speaker Bios

Eric Johnson

Eric Johnson is a Principal Security Consultant at Cypress Data Defense where he leads secure software development lifecycle consulting, web and mobile application penetration testing, secure code review assessments, static source code analysis, security research, and security tools development. He also founded the Puma Scan static analysis open source project, which allows software engineers to run security-focused .NET static analysis rules during development and in continuous integration pipelines.

As a Certified Instructor with the SANS Institute, Eric authors application security courses on DevOps, cloud security, secure coding, and defending mobile apps. He serves on the advisory board for the SANS Securing the Human Developer awareness training program, delivers security training around the world, and has presented his security research at conferences including SANS, BlackHat, OWASP, BSides, JavaOne, UberConf, and ISSA.

Eric completed a bachelor of science degree in Computer Engineering and a master of science degree in Information Assurance at Iowa State University, and currently holds the CISSP, GWAPT, GSSP-.NET, and GSSP-Java certifications. He is located in West Des Moines, IA and outside the office enjoys spending time with his family, attending Iowa State athletic events, and playing golf.

Cindy Blake

As Product Marketing Manager at HP, Cindy Blake brings a unique perspective that combines a technical background and history as a technology buyer with rich technology and marketing experience. Within HP Enterprise Security Products, Blake has applied advanced security intelligence to demonstrate use cases that transform traditional security approaches, leveraging unstructured data sources and non-traditional tools (HP Autonomy IDOL) to provide added risk insight. Blake developed a Security Maturity Curve, documented by Quinstreet, as an unbiased metric for enterprises to evaluate their security posture. She launched HP Application Defender, a SaaS-based application self-protection solution, and previously HP Threat Central, a crowd-sourced exchange to help enterprises more proactively identify threats.

Need Help? Visit our FAQ page or email

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.