Sign In

Andrew Hoffman

Senior Security Engineer at Coinbase

Andrew Hoffman is a seasoned security professional with extensive experience in secure architecture and engineering. He served as a Senior Security Architect at Coinbase from March 2021 to August 2022.13 During his tenure at Coinbase, Andrew was responsible for the secure design of several major flagship products, including:

  1. The world's first crypto-backed debit card (Coinbase Card)
  2. Coinbase ETH & ADA Staking
  3. Coinbase Mobile App & Wallet (React Native versions)3

Prior to his role at Coinbase, Andrew worked as a Senior Security Engineer at Salesforce for over 4 years, where he focused on vulnerability research, penetration testing, and acted as a security champion for developers working on the Salesforce platform.3

Andrew's career also includes positions as a Software Engineer at BitTitan and internships at Seeq Corporation and F5 Networks.3 He holds a Bachelor's degree in Computer Science and Economics from the University of Washington.1

Currently, Andrew is a Senior Staff Security Engineer at Ripple, where he has been working since September 2022.13 In this role, he is responsible for the secure design of flagship products and leads cross-team security initiatives.1

Andrew is also an author, having written "Web Application Security: Exploitation and Countermeasures," a critically acclaimed book on application security.2 The second edition of this book is set to be released in February 2024.2

Highlights

Feb 9 · linkedin

The 2nd Edition of Web Application Security: Exploitation and Countermeasures for Modern Web Applications was greenlit for production two weeks ago. It's finally available for pre-order on amazon.com (https://amzn.to/3usUEFK).

Some insights from the writing process & the changes you can expect from the 1st edition:

  1. Significantly More Advanced Content

The most requested additional content was always advanced content, and the new edition has 120 additional pages almost entirely focused on advanced content in both the offense and defense sections. Some examples of this include advanced methods of bypassing XSS & CSRF defenses, several more exotic forms of DoS, in-band, out-of-band & inferential data exfiltration techniques for most listed attacks, chaining XXE into more advanced vulnerabilities & a whole 20 pages on client-side attacks. Defense section has been updated with mitigations for each of the above and more.

  1. Reader Provided Improvements & Suggestions

Over 150 improvements & suggestions from readers where incorporated into this edition. Thank you all for the positive and constructive feedback, and if I wasn't able to incorporate your feedback into the 2nd edition don't worry it is still noted in case of a 3rd edition.

  1. Structural & Editorial Changes

O'Reilly Media dedicated additional editorial resources to this edition, and the entire book has been improved in terms of structure, pacing, grammar and localization. A primary goal of this book is to be accessible to anyone interested in learning application security, so excellent start-to-finish readability has been a core goal of mine since the first edition. Shoutout to my editors: Angela Rufino, Jennifer Pollock and Tonya Trybula.

Additionally I was able to get several excellent technical editors to double check the books technical accuracy. Shoutout to Dustin Kinsey, 😎 Nishil S., Caroline Wong, Jonathan Lamendola, Ming Chow & Chetan Karande .

#appsec #infosec #cybersecurity

Related Questions

What are Andrew Hoffman's main responsibilities at Ripple?
How did Andrew Hoffman contribute to the security design at Coinbase?
What is Andrew Hoffman's educational background?
What are the three pillars of application security defined by Andrew Hoffman?
What technologies does Andrew Hoffman specialize in?
Andrew Hoffman
Andrew Hoffman, photo 1
Andrew Hoffman, photo 2
Add to my network

Location

Seattle, Washington, United States