Video and slides synchronized, mp3 and slide download available at URL http://bit.ly/2twKjqE. David Rook talks about the Riot Games Application Security program and how they define Application Security at Riot, how they’ve grown to meet the demands of their fast paced engineering organization, why they’ve hired software engineers into their team and the tools they’ve developed to help Rioters globally build fun and safe experiences for their players. Filmed at qconlondon.com. David Rook is the Head of Application Security at Riot Games. He has held various application security roles in the financial services industry since 2006 before moving into the computer games industry in early 2014. He has contributed to several OWASP projects including the code review guide and the Cryptographic Storage Cheat Sheet.

1. Building secure player
experiences at Riot Games

2. InfoQ.com: News & Community Site
Watch the video with slide
synchronization on InfoQ.com!
https://www.infoq.com/presentations/
security-riot-games
• Over 1,000,000 software developers, architects and CTOs read the site world-
wide every month
• 250,000 senior developers subscribe to our weekly newsletter
• Published in 4 languages (English, Chinese, Japanese and Brazilian
Portuguese)
• Post content from our QCon conferences
• 2 dedicated podcast channels: The InfoQ Podcast, with a focus on
Architecture and The Engineering Culture Podcast, with a focus on building
• 96 deep dives on innovative topics packed as downloadable emags and
minibooks
• Over 40 new content items per week

3. Purpose of QCon
- to empower software development by facilitating the spread of
knowledge and innovation
Strategy
- practitioner-driven conference designed for YOU: influencers of
change and innovation in your teams
- speakers and topics driving the evolution and innovation
- connecting and catalyzing the influencers and innovators
Highlights
- attended by more than 12,000 delegates since 2007
- held in 9 cities worldwide
Presented at QCon London
www.qconlondon.com

4. 1
2
3
4
David Rook
5

7. Riot Application Security

8. tl;dr not this

9. Automation
Rioters
Bug Bounty
Riot Application Security

18. ESLint Security Rules

19. ESLint Security Rules

21. Dependency Scanner PoC

22. Dependency Scanner v1

23. Dependency Scanner v1

25. zz’review portal

26. zz’review portal

27. zz’review portal

28. zz’review portal

39. Questions?
@davidrook

40. Watch the video with slide
synchronization on InfoQ.com!
https://www.infoq.com/presentations/
security-riot-games