DevSecOps: Balancing development and security
summary
Claim: pre-release scanning alone misses the attacks that happen on users' devices, so add runtime checks and observability. Demo decompiles APKs in seconds to reveal API endpoints, hardcoded keys and Firebase checks, then shows a protected APK that hides the build config and encrypts secrets so they are no longer readable — protection works in the demo. Tools cited: ProGuard/RA obfuscation, Magisk rooting, APK decompiler; Imperium scans millions of apps and offers a 30-day trial for mobile app scanning, with runtime observability and encrypt build config to slow attackers.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 4:16DevOps lifecycle security
- 8:47Source code vs binary scanning
- 14:06Reverse engineering risks demo
- 18:25Static reverse engineering protection
- 20:11Runtime threats and Magisk
- 21:59Data protection and cryptography
- 24:09Security observability need
- 25:52Balancing security and speed
- 26:57Summary and call to action
related talks
34mDevSecOps: Balancing development and security
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
21mSecuring the Unseen: Advanced Threats, Best Practices & Challenges in Mobile App Security
42mAttack & Defend Mobile Apps
47mSecuring Android Applications
33mShielding Your Android App from Attackers
45mGoing Beyond Obfuscation: Advanced Techniques for Protecting Android Apps
44mAuditing Your APKs Like a Black Hat Hacker