Bridging the Dev-Sec divide: Three tips for agile developers
summary
Three concrete steps: run threat modeling sessions to map auth flows and surface real vulnerabilities, instrument a login router logs pipeline to get baseline metrics (400/200 ratio ~0.5%) and detect brute‑force spikes from single IPs, and use frameworks like STRIDE plus attack trees to prioritize fixes and add security acceptance criteria. The team builds monitoring dashboards, proves live attacks to business, implements mitigations, automates checks, starts knowledge‑sharing and a bug bounty, and shifts team behavior so the changes actually stick.
AI-written summary · about
chapters (6)
related talks
53mPractical tips for web application security in the age of agile and DevOps
01h 03mBe your own Threatbuster!
01h 04mShifting Security Everywhere
52mContinuous Security
33mLearning from Past Security Breaches: Strengthening AppSec Efforts and Focus
58mHow to embed security into your process
57mBuilding a Modern Security Engineering Organization
27mDevelopers Struggle with Application Security (and How to Make ...)