Shift-Left-Security with the Security Test Pyramid
summary
Argues that most OWASP Top 10 issues are testable early and shows a Spring Boot app with failing integration tests that reveal a SQL injection and mislayered persistence calls, plus static findings from SonarQube and Snyk and secret leaks from TruffleHog. Demonstrates architecture rules enforced with ArcUnit, password checks from ASVS, and automated API and baseline scans via OWASP ZAP in CI/CD; claims threat modeling + concrete security requirements produce repeatable unit/integration tests that catch real defects before release.
AI-written summary · about
chapters (15)
- 0:00Introduction to talk
- 2:01Testing pyramid explained
- 5:57OWASP Top 10 2021 changes
- 8:50Insecure design and threat modeling
- 11:15Security requirements with ASVS
- 14:46Threat modeling process
- 18:25Unit testing for security
- 24:28Demo: Static analysis and architecture
- 30:08Service layer security tests
- 32:34Demo: SQL injection detection
- 35:06Dynamic application security testing
- 38:18Demo: OWASP ZAP scanning
- 39:25Explorative testing and pen tests
- 41:51Summary and DevSecOps approach
- 42:39Q&A session
related talks
57mShift Left Security with the Security Test Pyramid
37mDeploying Security Testing Practice in Your Team and Company
27mHow to Start Security Testing Without Fear
06mInterview with
49mThe Security Testing Pyramid for Developers
57mThe Developer's Field Guide to Software Security
43mTest Driven Application Security
26mBeyond Testing: Application Security in the Age of DevOps