Test Driven Security in the DevOps pipeline
summary
Mozilla codifies a security baseline, embeds tests in CI/CD and blocks deploys that fail automated checks. Tooling includes headless OWASP ZAP in Docker with a one-minute zap scan, static analysis (bandit, ESLint), TLS Observatory and a custom pineapple infra test for AWS firewall rules, all triggered from Jenkins on each build. Policy-level controls like Content Security Policy are required. Result: automated checks catch regressions pre-prod, XSS reports drop sharply and bug bounty payouts fall from ~52 (2015) to ~43 (2016) and are projected to halve in 2017.
AI-written summary · about
chapters (16)
- 0:00Intro
- 2:19Julien Vehent
- 7:43Vulnerabilities by type
- 9:17Bug Bounty payouts
- 12:53A DevOps pipeline
- 16:24Test Driven Security
- 17:48Define a Security baseline
- 19:021. Writing a Security checklist
- 26:05Test the baseline
- 27:022.1 ZAP Baseline scanning
- 29:422.2 Static code analysis
- 30:442.3 Security group testing
- 32:112.3 Security testing
- 33:092.4 TLS Quality
- 35:51Gating prod deploys
- 37:31Does it work?
related talks
39mSecurity Tooling in Your DevOps Pipeline
42mContinuous Security: Integrate security tools into your DevOps Pipeline
45mSecurity Testing with OWASP ZAP in CI/CD
31mPenetration Testing in the Release Pipeline
01h 01mOpen Source Pentesting and Security Analysis Tools: the DevOps way… #slideless
45mAutomated Security Testing in a DevOps world
46mSecurity DevOps - Staying Secure In Agile Projects
52mApplication Security at DevOps Speed and portfolio scale