Secure Software Development
summary
Sets up Continuous Security Testing for a Java web environment by defining ten initial secure‑coding rules, integrating scans into Jenkins, and running scans centrally across ~60–70 projects. Uses FindBugs + FindSecBugs for fast static analysis and OWASP Dependency‑Check for dependency scanning, achieving static analysis maturity level 3–4 quickly; dynamic testing with ZAP/Burp remains limited. Automates intensity and quality gates, implements a small custom web.xml checker, and reduces false positives and rework.
AI-written summary · about
chapters (21)
- 0:00Introduction
- 2:56What is this?
- 5:08Why are we doing this?
- 10:31WASC Catalog
- 12:15Context
- 12:51An Example
- 17:33Example: SQL Injection
- 18:29Example: Technical Error Messages
- 22:01Jenkins Report
- 24:02Web.xml Checker
- 27:334 Different Axes
- 27:51Static Depth
- 29:00Dynamic Depth
- 33:30Consolidation
- 34:50This Project Achieves...
- 36:28OWASP Proactive Controls
- 37:31Dynamic Analysis (DAST)
- 37:44Zed Attack Proxy (ZAP)
- 41:31Security Frameworks Apache Shiro
- 43:41Additional Tools
- 45:23Key Success Criteria
related talks
46mSecurity DevOps - Staying Secure In Agile Projects
45mAutomated Security Testing in a DevOps world
06mInterview with
37mDeploying Security Testing Practice in Your Team and Company
46mStrengthening Java Apps: Best Practices in Secure Coding for Java Developers
52mApplication Security at DevOps Speed and portfolio scale
42mSecure or Insecure Code, That Is the Question
43mSecurity in DevOps Strategies