Shift up: Continous Security and feedback loop
summary
Proposes a continuous feedback loop that automatically syncs production security policies (WAF/VA rule regexes, attack signatures) into non-production and back, so regressions from point-in-time pen tests are caught; uses vulnerability assessment, dynamic application testing (DAST), and pen testing, and recommends running paired tests with and without WAF to measure real resilience. Gives a concrete failure: a telco’s misconfigured SQLi rules let attackers in and were only found via bug bounty. Claims this approach worked for several customers who reduced policy drift and repeated vulnerabilities.
AI-written summary · about
related talks
41mSkillful, Scalefull Fullstack Security in a State of Constant Flux
36mHow to build continuous security and embed it in your product
53mPractical tips for web application security in the age of agile and DevOps
44mApplication Security: Everything we know is wrong
46mRugged Software Engineering
52mContinuous Security
49mStop Chasing Vulnerabilities - Introducing Continuous Application Security
40mMaking Security an integrated part of the SW Dev Lifecycle