AppSec at DevOps Speed and Portfolio Scale
summary
Argues for instrumenting an entire IT organization with passive sensors that collect HTTP, data‑flow and control‑flow evidence to detect vulnerabilities in realtime and at portfolio scale; demonstrates concrete sensors — a clickjacking checker that verifies X‑Frame‑Options, a CSRF detector run via ZAP + Zest and Selenium proxying, an access‑control extractor that generates live matrices, and library checks using dependency-check in CI — deployed across hundreds to thousands to >10,000 apps and feeding dashboards that replace slow pen tests.
AI-written summary · about
chapters (14)
- 0:00Intro
- 1:02Application Security Is Healthcare
- 2:29Sensors Are Revolutionizing Healthcare
- 4:06Traditional Tools and Techniques Are Failing...
- 8:18Defining "Portfolio Scale"
- 11:38Designing a Clickjacking Sensor
- 16:36CHECK YOUR HEADERS
- 19:59Access Control Intelligence Sensor
- 21:09Generated Access Control Matrix from Code
- 24:16CSRF Defense Sensor
- 25:23Canonicalization Correctness Sensor
- 27:05Injection Sensors
- 36:33Continuous Application Security!
- 43:54Transforming AppSec
related talks
52mApplication Security at DevOps Speed and portfolio scale
58mOpen Source Pentesting and Security Analysis Tools: the DevOps way
48mAppSec++ Take the best of Agile, DevOps and CI/CD into your AppSec Program
01h 01mOpen Source Pentesting and Security Analysis Tools: the DevOps way… #slideless
46mSecurity DevOps - Staying Secure In Agile Projects
45mAutomated Security Testing in a DevOps world
41mSkillful, Scalefull Fullstack Security in a State of Constant Flux
59mWhy Your AppSec Experts Are Killing You