Sponsored Session: Application Security is a Community Effort
summary
Shows how GitLab actually wires open source into its security pipeline: DAST builds on OWASP ZAP, container scanning reuses Trivy, and secret detection extends git-leaks. Presents a CVE lifecycle, threat modeling practices, and a concrete user contribution: a grocery chain adding a mobile scanner to pipelines. Claims 2,000+ external contributors to GitLab, argues open source speeds detection and lowers remediation cost, and flags sustainability problems when projects lose contributors and shift to alternatives like Kubernetes.
AI-written summary · about
chapters (19)
- 0:00Application security intro
- 1:04Open source security benefits
- 3:29Transparency in open source security
- 5:37Sustaining open source communities
- 6:18Cost savings with shared security tools
- 8:06Collaboration in security innovation
- 10:34Security learning resources
- 12:21Open source security scanners
- 15:13Getting started with contributions
- 17:00Threat modeling basics
- 18:23Vulnerability disclosure process
- 20:07Vulnerability life cycle
- 21:53Remediation costs in development
- 22:55Quality control in open source
- 24:00Sustaining open source projects
- 26:14GitLab’s open source model
- 28:19Community-driven development
- 31:35Security tools integration framework
- 32:58Summary and Q&A
related talks
43mApplication Security is a Community Effort
05mApplication Security is a Community Effort
17mShift-Left Security in Practice with Gitlab
38mDevOps Meet Sec: Your Journey To Delivering Secure Code Fast
44mOpen Source Security: The World Needs Our Help
19mApplication Security at High Velocity
54mFrom App Security to Dev Security – Shift left with GitHub Advanced Security
44mYes, Application Security Leads to Better Business Value. Learn How from Experts.