Bringing Security Testing To Development: How To Enable Developers To Act As Security Experts
summary
A concrete program integrates static + dynamic tooling into development: IDE quick checks, CI scans, and periodic full validation and penetration tests in production. Risk-based test plans map language, framework and component to tools and manual checks; surprising operational result: many field-reported bugs are either undetectable by current tools or stem from really old 10–20 year products. Metrics track percent of reportable vulnerabilities that become automatable over time and measure reductions in late fixes.
AI-written summary · about
chapters (6)
- 0:00Bringing Security Testing To Development: How To Enable Developers To Act As Security Experts
- 12:12Example: Security Test Plan
- 13:48Example: Security Test Report
- 16:48Security Validation
- 19:15How to Measure Success
- 31:21Conclusion
related talks
27mDevelopers Struggle with Application Security (and How to Make ...)
40mMaking Security an integrated part of the SW Dev Lifecycle
26mBeyond Testing: Application Security in the Age of DevOps
06mInterview with
42mContinuous Security: Integrate security tools into your DevOps Pipeline
57mThe Developer's Field Guide to Software Security
37mDeploying Security Testing Practice in Your Team and Company
39mSecurity Tooling in Your DevOps Pipeline