Juggling the Elephants: Making AppSec a Continuous Program
summary
Presents a repeatable Continuous AppSec Model: build an application portfolio profiling that scores 500+ apps objectively (Excel or Archer questionnaires), use the score to drive a risk-based assessment strategy (SAST/DAST, manual code reviews, threat modeling), publish reference architectures and standard components (SiteMinder, .NET guidance) to auto-generate threat models, and automate pipelines with Jenkins to make security self-service. Model is tailorable, implemented at enterprises, maps to OWASP SAMM (addresses seven SAMM practices), and produces metrics that enable continuous improvement and faster, auditable releases.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:30Agenda
- 2:26The Tunnel
- 4:44Application Portfolios
- 6:24Challenges
- 8:07Continuous Program Approach
- 14:03Application Profiling Components
- 15:34Assessment Strategy
- 17:43What Fits Our Organization
- 19:08Design Enablement
- 22:30Reference Architecture
- 27:17Analysis Metrics
- 32:58DevOps Integration
- 41:12Questions
related talks
57mKeynote: Maturing Your Application Security Program
49mStop Chasing Vulnerabilities - Introducing Continuous Application Security
08mRunning an Appsec Program with Open Source Projects"
48mAppSec++ Take the best of Agile, DevOps and CI/CD into your AppSec Program
55mAh mom, why do I need to eat my vegetables?
33mJumpstarting Your Appsec Program
36m5 Steps to Drive Enterprise Software Security
57mWhat’s in an AppSec program?