Security for Developers
summary
Advocates making security part of development by running SAST tools during coding, DAST against running applications, and adopting IAST for real‑time coverage. Explains that SAST finds many configuration and code issues but yields frequent false positives, DAST uncovers runtime vulnerabilities but can miss deep code flaws, and IAST offers precise results though supports few languages; recommends integrating SAST and DAST into CI/CD to reduce post‑release fixes and incidents like the Vivo, Unimed and membership database leaks.
AI-written summary · about
chapters (8)
- 0:00Security in development
- 3:11Web attack growth and responsibility
- 6:44Static and dynamic analysis tools
- 10:22SAST advantages and limitations
- 12:46Security knowledge for devs
- 15:36Evolving to real-time interactive tests
- 18:51Choosing the right tool
- 20:36Closing and contact
related talks
50mSAST'madness and Courage
25mHow to select between SAST, DAST, IAST, RASP, and AST
21mAdding DAST to CI/CD, Without Any Losing Friends
57mQuantifiable Quality: The New Standard of Secure Code
44mSecurity Practices Useful in Agile Development
33mUsing IAST to Unlock the Benefits of DevSecOps
13mUnderstanding DevSecOps: Risk defense across your SDLC
26mBeyond Testing: Application Security in the Age of DevOps