for agents/llms.txtv0.12.78

Home / Articles / A web application security challenge to Portugal, 2010: my IBWAS keynote in Lisbon, slide by slide, with what came true, what I got wrong and what still stands

A web application security challenge to Portugal, 2010: my IBWAS keynote in Lisbon, slide by slide, with what came true, what I got wrong and what still stands

By · 2026-10-16 · article v1.0.0 · newsroom v0.12.78 · portugalowaspapplication-securitytalkshistoryregulationeuropeopen-sourcehacking-portugalarticle

Abstract: In December 2010, at OWASP's IBWAS conference in Lisbon, I gave a keynote called A 'Web Application Security' Challenge to Portugal. It had 168 slides, five proposed focuses and twelve proposed actions for government and industry, from allowing ethical hacking and publishing security score cards to liability for software, an independent vulnerability-disclosure agency, paying for open-source security and proper SSL for half of all websites. It ended with an argument that Portugal, which had nothing to lose, could become the Switzerland of hacking. Reading it again sixteen years later, more of it came true than I expected, though mostly from Brussels rather than Lisbon: software now falls under strict product liability, Europe has its own vulnerability database, manufacturers must report exploited vulnerabilities, and encrypted connections are the norm. What I got wrong was the mechanism. I thought fear of disasters would move governments; what moved them was regulation built slowly over a decade. And the part about Portugal itself, an open, ethical security industry as a way out of a depressed economy, is still mostly to do. This is the first of a series of articles on the talks I have given about Portugal, ahead of a new edition of Hacking Portugal.

Twelve slides from the IBWAS 2010 keynote in Lisbon: the title, the five proposed focuses, the twelve proposed actions such as allowing ethical hacking, score cards, procurement requirements, rewriting computer laws and open-sourcing end-of-life applications, application security as health and safety, a country-wide fire drill, and Portugal as the Switzerland of hacking.

In short

The talk

On 17 December 2010 I gave the keynote at IBWAS'10, OWASP's Ibero-American web application security conference, at ISCTE in Lisbon. Its title was A 'Web Application Security' Challenge to Portugal, and others that care about application security, and its first slide was a disclaimer: "this is my personal opinion". A few weeks later I wrote that "There are a lot of thought provoking ideas in there, and I don't expect that some of them will become reality any time soon." The press picked up one line: Portugal could be the "Switzerland of hacking".

The deck has four movements: a new paradigm, as five focuses and twelve actions; a section on fear, with the disasters that would follow if we kept ignoring software; examples from Portuguese websites; and a challenge to Portugal. This article goes through them with what I think today.

Five focuses

The five focuses were: treat software and application security "with the respect and care that it deserves"; view application security as business intelligence; view it as competitive advantage; make the application security market "work"; and use OWASP as a resource and enabler.

What still stands. All five, and the second one more than I could have known. "Application security as business intelligence" was the idea that understanding how your software really works is valuable in itself, beyond finding bugs. Today that is exactly what I argue for agents and graphs: the value of GenAI is that it can understand, and a security team's job is to understand reality. The fourth, a market that works, is still the weakest: buyers still cannot easily tell secure software from insecure software.

Twelve actions

The twelve actions were for government or industry: allow ethical hacking; publish the results of security reviews as score cards; put security requirements in procurement; introduce liability for government and publicly traded companies; create an independent vulnerability-disclosure agency; rewrite computer laws; pay for open-source security; demand that widely used end-of-life applications, like IE6, be open sourced; create an insurance market; reduce the assets held, secrets and private data; improve journalism; and "'Proper' SSL support for 50% of websites".

What came true, mostly from Brussels.

What did not. Score cards for software, an insurance market that prices application security well, and paying for open-source security at the scale it needs. On the last one I wrote this month that open source receives a tiny share of its value in investment. Reducing the assets held is the one I would put first today: the best way to protect data is not to have it, or to hold only ciphertext, which is what sgit does.

The fear section

The middle of the deck was deliberately scary: everything is broken, "Its software everywhere", "How many many people will have to die before we take application security seriously?", and a game, "Bring the internet down for a day", a country-wide fire drill. I compared software to health and safety: we expect a minimum level of quality from water, food, cars and planes, and have laws that regulate them; "But, we have very little (if anything) in software and web applications".

What I got wrong. The analogy was right, and the mechanism was wrong. I thought fear, and a big enough incident, would move governments quickly. What moved them was a decade of slow, unglamorous regulation. Health and safety for software is arriving the way health and safety arrived for everything else: through liability and reporting duties, not through a single disaster.

The challenge to Portugal

The last part was personal and blunt. I talked about my frustration with Portugal, a country I described as depressed, "and really needs new ideas", and argued that application security could be one of the solutions, "by showing how an open, vibrant, ethical, multi-cultural industry can work and flourish". Portugal had "nothing to lose (it is already rock-bottom)"; what I was asking for "doesn't cost any money"; "It only takes courage, focus and commitment". And: Portugal could become the "Switzerland of Hacking".

What still stands. The core of it: a small country can choose a sector and lead in it. Sixteen years later I made the same argument in Judo for small countries, about AI. Portugal is no longer the depressed country of 2010, and some of the bluntness reads differently now. But Portugal did not become the Switzerland of hacking. That is the thread the next talks pick up: Hacking Portugal in 2016, and GenAI in Portuguese in 2024.

What this does not claim

If you were at IBWAS in 2010 and remember it differently, write to agent@riskmandate.ai.

Where this comes from

A voice memo of mine on 16 October 2026, written by this site's agent in the voice of this site; the commentary and the editorial responsibility are mine. The slides, A 'Web Application Security' Challenge to Portugal, December 2010, on the OWASP wiki, and my blog post of 12 January 2011. For today: the Product Liability Directive, via Hogan Lovells; the European Commission on the EUVD, 13 May 2025; the Cyber Resilience Act's reporting duties, via McCann FitzGerald; Decreto-Lei 125/2025, via PwC Portugal. Read on 16 October 2026.

Threads

News & evidenceStartups & strategy This article as a graph →

Builds on

Continued by

All articles · All graphs

Article No. 149 · start a reading list with it

Want the next issue by email. One issue a week or so: what was published, what it adds up to, and what is worth your time. Subscribe to the SGit Newsroom →

← All articles