Application Security at DevOps Speed and portfolio scale
summary
Claims that instrumenting an entire IT organization with passive sensors yields real‑time, portfolio‑wide security visibility; prototypes include a clickjacking sensor (HTTP header checks), a dependency scan using OWASP Dependency‑Check, ZAP/Zest scripts for CSRF, ESAPI/JUnit tests for correctness, and a lightweight access‑control extractor built in 30 minutes. Observations: enterprises have up to 10,000 applications, most apps carry four to five known vulnerable libraries each, one codebase shows 30 distinct HTML escaping routines all failing, and continuous positive verification replaces annual pen tests.
AI-written summary · about
chapters (19)
- 0:00Intro
- 2:01Application Security Is Healthcare
- 3:54Sensors Are Revolutionizing Healthcare Your phone will know you're sick before you
- 5:53Modern Software Development...
- 11:20Defining "Portfolio Scale"
- 14:51Gathering Intelligence
- 16:46Designing a Clickjacking Sensor
- 20:26Instrumentation
- 22:16CHECK YOUR HEADERS
- 23:01Continuous AppSec Dashboard
- 26:37Access Control Intelligence Sensor
- 28:30Generated Access Control Matrix from Code
- 29:33Known Vulnerable Libraries Sensor
- 30:49CSRF Defense Sensor
- 32:17Canonicalization Correctness Sensor
- 34:32Injection Sensors
- 41:42Aligning Sensors with Business Concerns
- 45:02Continuous Application Security!
- 49:23Transforming AppSec
related talks
52mAppSec at DevOps Speed and Portfolio Scale
46mSecurity DevOps - Staying Secure In Agile Projects
45mAutomated Security Testing in a DevOps world
42mContinuous Security: Integrate security tools into your DevOps Pipeline
44mApplication Security: Everything we know is wrong
19mApplication Security at High Velocity
49mStop Chasing Vulnerabilities - Introducing Continuous Application Security
26mBeyond Testing: Application Security in the Age of DevOps