Tune your Toolbox for Velocity and Value
summary
Organization is buried in SAST DAST and SCA results with false positives, no triage and no metrics; fixes focus on tool tuning, inventory and process change. Recommendations include running IDE scanners for fast feedback, teaching scanners custom sanitizers, treating SCA as an inventory to track urgent CVEs, and centralizing risky APIs — one case reduced 300 findings to 1 by wrapping logging. Emphasis on measurable targets, planned remediation and management-backed developer time.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:50Unstructured security tools
- 9:22Understanding security tools
- 18:49Configuring tools for use
- 25:10Measuring tool effectiveness
- 34:38Triage methodology
- 42:42Strategic remediation
- 50:30Key takeaways
- 51:36Q&A
related talks
33mOverwhelmed by Vulnerability Triage Hear a Blend of Finest Best Practices
40mDevSecOps Guide to Bulletproof Your Development Workflow
01h 06mEscaping Vulnerability Hell: Bridging the Gap Between Developers and Security Teams
33mBattle Tested Application Security
48mThe Quick Wins of DevSecOps
39mFrom Auditions to Opening Night: Selecting Security Tools that... (Saurabh Sharma)
45mEradicating Vulnerability Classes by Shelving SAST and Embracing Secure Defaults and Invariants
28mThe path to agile DevSecOps – a holistic approach of automation, orchestration and correlation