Agile Application Security
summary
Argues that checkbox security is theater and agile demands security become an enabler, not a gatekeeper, by shipping frequently and accepting continual risk. Recommends splitting teams into security engineering and ops, using infrastructure as code (Puppet, nginx/varnish manifests), CI pipeline scans and cucumber-style tests, a running risk log tied to stories, and appointing a team security owner. Cites surprising metrics like 270 days median breach detection and a typical 100:1 developer to security ratio to justify automation and focused controls.
AI-written summary · about
chapters (11)
- 0:00Introduction to GDS security
- 1:00The state of cyber security
- 4:26Criminal economy and malware
- 8:48Advanced persistent threats
- 14:31Failures of traditional security
- 18:43Agile and security philosophy
- 23:50Agile delivery in government
- 28:35Security design principles
- 36:56Implementing agile security
- 46:41Microservices and security
- 50:58Operational security and conclusion
related talks
46mApplication Security in an Agile World
29mPainless Agile Security
45mApplication security loves Agile
13mAgile in Security and Security in Agile
27mStandard Classification: Achieving Security by Shifting Left in Agile
44mSecurity Practices Useful in Agile Development
54mScaling Security in Agile Scrum
53mPractical tips for web application security in the age of agile and DevOps