Transformation Blueprint for Developer-Centric Application Security
summary
A practical blueprint for shifting appsec onto engineering: run a pairing service to add a single hello world test (Cypress/Playwright/Postman), gate PRs with the test and a coverage blocker, run parallelized ephemeral CI and SCA, adopt IAST-style security in the pipeline, and use a half‑day workshop plus 90‑day coached sprints to prioritize developer-specific practices. Results at scale: 600 teams (10,000 devs) reach roughly 80% test coverage within months and see one‑sixth as many vulnerabilities in production.
AI-written summary · about
chapters (8)
- 0:00Introduction and background
- 3:27Defining devsecops
- 5:38Lessons from past failures
- 11:56Prerequisites for security
- 25:32Pull request gatekeeping
- 34:30Contextual learning model
- 40:31Collaborative policy building
- 53:09Gamification and coaching
related talks
27mDevelopers Struggle with Application Security (and How to Make ...)
26mBeyond Testing: Application Security in the Age of DevOps
27mSecurity Learns to Sprint: DevSecOps
54mFrom App Security to Dev Security – Shift left with GitHub Advanced Security
28mHow to Effect Change in the Epistemological Wasteland of App Security
40mMaking Security an integrated part of the SW Dev Lifecycle
33mWhy Developers Struggle with API Security
57mDev-first security: From code to cloud, and back to code (PRT291)