AppSec in a DevOps World
summary
Claims that training developers eliminates many security costs and that shifting security left finds bugs earlier drive the talk: concrete fixes include using OWASP Top Ten as a checklist, adopting parameterized queries to stop SQL injection, and adding CI/CD pipeline enforcement and IDE checks. Measured examples show scanned findings dropping from ~100 to 40 to a handful and a program of security champions (multi‑day training) acting as a force multiplier that actually works.
AI-written summary · about
chapters (14)
- 0:00Start
- 9:15The Goal?
- 10:13When do we fest?
- 11:32Fitting into Agile and DevOps
- 12:52The real cost of a bug?
- 16:09What's a DevOps Team?
- 17:06DevOps - Process: Where is security?
- 18:27The First Way: Systems Thinking
- 20:14Mutual Accountability
- 22:48Measurement is key
- 23:37Training and Awareness
- 24:55Train Security on the Process
- 26:16The Third Way: Experimentation and Learning
- 27:41Security Champions
related talks
38mAppSec is Dead Long Live DevSecOps!
42mAppSec is dead. Long live DevSecOps!
47mSecurity is Everybody's Job
26mBeyond Testing: Application Security in the Age of DevOps
30mThe 3 Ways of DevSecOps – Making Shift Happen
54mFrom App Security to Dev Security – Shift left with GitHub Advanced Security
30mThe AppSec Error Loop: How We Can Stop Repeating Common Security Mistakes
31mTopics of Interest: Scaling AppSec through Education