Design Approaches for Security Automation
summary
Argues decisions rest on concrete tradeoffs not buzzwords: whether build, buy, or borrow depends on who will maintain it, how collected data gets processed, and whether results drive decisions. Cites concrete tools and patterns—ZAP/Burp scanning, Mozilla Minion, Gauntlet-style assertion-based tests, Jenkins/Maven integration, Celery/Rabbit queuing—and design wins like separate tools from core engine, REST APIs and incremental deployments. Claims measurable, low‑false‑positive checks (CSP headers, binary yes/no tests) outperform blunt large‑scale scans unless a clear plan exists for handling the output.
AI-written summary · about
chapters (27)
- 0:00Introduction
- 2:22Why
- 5:36Rock Stars
- 6:45Data Management
- 10:17Web Application Security Assessment
- 16:34Integration
- 18:00Compliance
- 18:51Library Component Tracker
- 19:54Code Review Checker
- 20:44Build vs Buy
- 21:34Source Code
- 22:36Behavior Driven Tools
- 22:50Security Assertion Model
- 23:38Incremental Design
- 25:20Separate Reporting
- 26:04Dynamic Variables
- 28:01Tools
- 29:03Rest API
- 30:20Platform Choice
- 30:40Web Web
- 31:29Safety Support
- 31:56Technologies Used
- 32:40Design Principles
- 33:21Automation Framework
- 34:03Small Steps
- 35:31Summary
- 37:21Wrap up
related talks
38mDesign Approaches for Security Automation
39mSecurity Tooling in Your DevOps Pipeline
52mContinuous Security
49mPragmatic Approaches To Building Secure Software
44mSecurity Practices Useful in Agile Development
40mMaking Security an integrated part of the SW Dev Lifecycle
06mInterview with
26mBeyond Testing: Application Security in the Age of DevOps