Case Study: 10 Steps to Agile Development without Compromising Enterprise Security
summary
Claims implementation of an SSDLC across 22 SCRUM teams and ~200 developers covering up to 1M lines of code with measurable controls: OWASP ESAPI package as a company API, static code analysis as a Maven step plus artifact and OSS vulnerability scans, unit tests and automated security tests in CI, and customer plus external pen tests (~40 total, ~2/month). Builds fail on high/medium findings via TeamCity CI that blocks releases, nightly scans for long builds, and adoption scales from pilot to companywide.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 0:21Security Development Lifecycle in Agile
- 2:46About me
- 3:14What is LivePerson
- 7:36Discovery Phase
- 12:50Spring Backlog
- 13:50Checkpoints
- 14:09Security High Level Design
- 18:47The Work
- 24:19Code
- 28:21Validation
- 28:38Why Validation
- 30:08Example
- 31:36Unit Test
- 32:29Summary
- 32:58Checkin
- 34:57User Experience
- 35:42Benefits
- 36:52Summarize
- 40:39Treat your RD organization well
- 43:47Feed this program
- 44:08QA
related talks
54mScaling Security in Agile Scrum
40mDevSecOps Guide to Bulletproof Your Development Workflow
40mSecurity Automation in the agile SDLC - Real World Cases
56mSo Long Secure Coding - Practical Steps for Securing the entire SDLC
45mAgile Security Testing - Lessons Learned
46mApplication Security in an Agile World
44mSecurity Practices Useful in Agile Development
13mAgile in Security and Security in Agile