Beyond Testing: Application Security in the Age of DevOps
summary
Argues that security belongs before, inside and after the CI/CD pipeline and gives five concrete principles including Automate Security In, Integrate to Fail Quickly, Keep Operational Visibility. Cites measurements: 35% of apps contain hard‑coded credentials, 32% show SQL injection, ~70% have a top‑ten web vuln on first test. Recommends SAST DAST SCA, IDE hooks, CI automation, RASP and measured coaching — computer training raises fix rates ~30% while remediation coaching more than doubles fixes — to avoid stopping the pipeline.
AI-written summary · about
chapters (14)
- 0:00Intro
- 0:59Culture Clash
- 2:05DevOps vs Security
- 2:46Hidden Costs
- 4:25Snowflake Way
- 5:27Data Breach Visualization
- 6:29Application Security
- 9:00Application Security Principles
- 10:29Automated Security Testing
- 13:58Failing Early
- 14:54False Positives
- 17:05DevOps
- 21:02Security
- 25:06Conclusion
related talks
13mEffective Application Security Testing for DevOps
44mSecurity Practices Useful in Agile Development
31mDevOps: You Build It, You Secure It
37mDeploying Security Testing Practice in Your Team and Company
39mSecurity Tooling in Your DevOps Pipeline
29mSecuring Your Web Application Pipeline From Intruders
47mSecurity is Everybody's Job
30mAppSec in a DevOps World