The Security Testing Pyramid for Developers
summary
Explains how to extend Mike Cohn’s test pyramid to include automated security testing at every layer so continuous delivery keeps applications safe. Shows concrete techniques and live demos using a Spring Boot/Java backend to automatically detect vulnerabilities such as broken authentication, authorization issues, input validation flaws, and SQL injection, mapping coverage to many OWASP Top 10 categories.
AI-written summary · about
chapters (22)
- 0:00Intro
- 1:09The Testing Pyramid (by Mike Cohn)
- 2:54The Testing Pyramid (by Gregory / Crispin)
- 4:24OWASP Top 10 - 2021
- 5:53OWASP Top 10 - A04:2021 - Insecure Design
- 9:31Derive Tests from Security Requirements
- 10:46Threat Modeling
- 12:48Application Security Verification Standard
- 14:49The Security-Testing Pyramid: Unit Test Layer
- 16:36Security on the Unit Testing Layer
- 17:11Static Application Security Testing (SAST)
- 19:19Secure Architecture & Design Testing
- 20:57V2: Authentication (ASVS)
- 30:23The Security-Testing Pyramid: Service Test Layer
- 31:48V5: Validation, Sanitization Verification (ASVS)
- 32:237.5 Testing for SQL Injection (Web Security Testing Guide)
- 33:41V4: Access Control (ASVS)
- 39:59The Security-Testing Pyramid: DAST
- 40:50Dynamic Application Security Testing
- 44:07The Security-Testing Pyramid: Explorative Security Tests
- 45:19Penetration Tests
- 46:46Summary: The Security Testing Pyramid
related talks
44mShift-Left-Security with the Security Test Pyramid
57mShift Left Security with the Security Test Pyramid
26mBeyond Testing: Application Security in the Age of DevOps
37mDeploying Security Testing Practice in Your Team and Company
45mBringing Security Testing To Development: How To Enable Developers To Act As Security Experts
27mHow to Start Security Testing Without Fear
06mInterview with
45mAutomated Security Testing in a DevOps world