Security Learns to Sprint: DevSecOps
summary
Argues that security stops being the bottleneck by matching DevOps cadence: break security work into sprints, make critical security bugs break the build, and run slow SAST/SCA as an asynchronous pipeline so teams can deploy (20 times a day) while long scans run separately. Recommends creating negative unit tests from pen tests, using tooling like OWASP DefectDojo, inviting developers into incident sims and security sprints, and iterating on controls (Netflix’s RepoKid approach) rather than bluntly removing privileges.
AI-written summary · about
chapters (36)
- 0:00Introduction
- 0:45Security is everybodys job
- 1:05DevSecOps
- 1:17Security in DevOps
- 2:00What is AppSec
- 2:36Other problems
- 3:07Security training
- 3:33Being outnumbered
- 3:51Statistics
- 4:14Waterfall
- 4:44StepSetCops
- 5:14DevOps
- 6:07Improve Deployment Frequency
- 6:40Resiliency
- 7:15Faster timetomarket
- 7:50Open Web Application Security Project
- 8:21Three Ways of DevOps
- 9:47Left to Right
- 11:22Photo Slides
- 13:37Asynchronous Pipeline
- 15:12Be Creative
- 15:24Faster Feedback
- 16:03What does this mean for DevOps
- 18:17Listen
- 19:32Negative Unit Tests
- 19:44Positive Unit Tests
- 20:26What Else
- 22:14Sharing information
- 23:05Security exercises
- 24:20Enabling DevSecOps
- 24:39Teamwork
- 24:52Security Champions
- 25:17Resources
- 25:36Professional Mentors
- 25:53Free Content
- 26:21Everyones Job
related talks
40mMaking Security an integrated part of the SW Dev Lifecycle
40mDevSecOps Guide to Bulletproof Your Development Workflow
31mDevSecOps, or How to Integrate Security into DevOps Practices
01h 04mShifting Security Everywhere
38mDevOps Meet Sec: Your Journey To Delivering Secure Code Fast
42mAppSec is dead. Long live DevSecOps!
34mDevSecOps: How to Use DevOps to Make You More Secure
37mDevSecOps Guide to Bulletproof Your Development Workflow