DevSecOps: Balancing development and security
summary
Claims that Zimperium scans every Play Store app and finds 80% of Android apps lack obfuscation, demos showing APKs decompiled to reveal API keys and SSL certs, and a protected build that strips or mangles classes so strings and config files become unreadable. Shows runtime bypasses using Magisk hides root from apps and explains SSL‑pinning can be unpinned “in 30 seconds.” Recommends continuous binary scanning during build plus runtime security observability and whitebox cryptography for key protection.
AI-written summary · about
chapters (9)
- 0:00DevSecOps introduction
- 3:57Application attack vectors
- 10:42Binary scanning in mobile security
- 16:49Reverse engineering and code protection
- 22:30Runtime attacks and vulnerabilities
- 24:19Whitebox encryption and key protection
- 28:56Security observability and defense
- 31:05Speed versus security in pipelines
- 32:30Key takeaways
related talks
28mDevSecOps: Balancing development and security
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
21mSecuring the Unseen: Advanced Threats, Best Practices & Challenges in Mobile App Security
21mUnlocking Mobile App Security- Key Insights for Navigating a Rapidly Evolving Threat Landscape
29mSecuring Android: Tackling Advanced Threats and Enhancing App Security
47mAttacking Android Applications
47mSecuring Android Applications
28mSecure Development whit Android