AppSec++ Take the best of Agile, DevOps and CI/CD into your AppSec Program
summary
Adopts CI/CD ideas into AppSec with concrete results: pipeline architecture (intake → triage → parallel testing → vulnerability repo → Jira) that automates glue code, reduces drudgery and yields measurable throughput — at one company assessments grow from 44 to ~200 (roughly 5x). Uses tools and patterns: Bag of Holding intake, scanners like ZAP Burp Suite Veracode AppSpider Qualys, centralizes findings in ThreadFix/Defect Dojo, injects checks via Jenkins and scales tests with Docker containers.
AI-written summary · about
chapters (29)
- 0:00Intro
- 0:17Matts background
- 0:44Custom AppSec
- 1:37Henry Ford
- 2:14Phoenix Project
- 3:02Workflow
- 3:55Testing
- 4:34Burrito Your Way
- 5:24AppSec Pipeline
- 9:31Key Features
- 12:55Pipeline
- 16:56Build Pipelines
- 18:26Deming Quote
- 18:40Optimizing People Time
- 23:18Pearson
- 24:45Call to Action
- 25:44Please bug all vendors
- 27:07Chat integration
- 27:42Automation
- 29:46Culture of Innovation
- 30:16Whats Next
- 30:26Weaponizing Jenkins
- 35:47Demo
- 37:49Scale
- 38:52Jenkins Pipeline
- 39:25Open Source
- 39:46Pipeline is Code
- 40:20Open Projects
- 43:01Defect Dojo
related talks
57mWhat’s in an AppSec program?
45mLessons From DevOps: Taking DevOps Practices Into Your AppSec Life
43mBuilding a Secure DevOps Pipeline
46mSecurity DevOps - Staying Secure In Agile Projects
46mBuilding An AppSec Pipeline: Keeping Your Program, And Your Life, Sane
52mAppSec at DevOps Speed and Portfolio Scale
51mTaking AppSec to 11: Pipelines, DevOps and making things better
42mAppSec is dead. Long live DevSecOps!