Agile Security Testing - Lessons Learned
summary
Claim: reshaping waterfall pen‑testing into embedded sprint work yields secure releases and lower cost. Pilot runs for about a year, joins grooming and spends 4–8 hours per team weekly onsite, tags stories in JIRA, adds security tasks and defects, and does immediate code reviews so 80–90% of final review happens during the sprint. Pentests shrink from a five‑day blocking ceremony to targeted 0–5 day checks. Uses SCA and small scripts for automation; approach proves practical and repeatable.
AI-written summary · about
chapters (14)
- 0:00Intro
- 1:07Agenda
- 2:32Davids background
- 10:00Learning Agile
- 18:25Good and Bad
- 27:10Security Findings
- 29:56Practical Approach
- 32:29Shared Knowledge
- 32:57Perfect Security Dream
- 34:18Security testers
- 35:39Code refueling
- 36:06Be efficient
- 36:31Automation
- 37:36QA
related talks
46mApplication Security in an Agile World
29mPainless Agile Security
54mScaling Security in Agile Scrum
27mSecurity Learns to Sprint: DevSecOps
13mAgile in Security and Security in Agile
46mMaking Security Agile
50mCase Study: 10 Steps to Agile Development without Compromising Enterprise Security
57mAgile Application Security