Lessons From DevOps: Taking DevOps Practices Into Your AppSec Life
summary
Claims a DevOps-style appsec pipeline is practical not just aspirational it wires repo commits, unit tests, scanners and manual work into an automated flow that feeds ThreadFix and yields concrete metrics. Tools used: Jenkins, Ansible/Chef/Puppet/Salt, deployable artifacts and small retest scripts in Go or Python. A concrete number: teams at scale hit 75 deploys per week, so the policy is SLAs for a mitigation-plan (24 hours for critical) not fixed dates. Outcome: fewer false positives, faster retests, visible work-in-process and repeatable hardened deployments.
AI-written summary · about
chapters (34)
- 0:00Intro
- 0:55About Matt
- 2:18About OWASP
- 3:29Whats the problem
- 4:56Traditional software
- 6:36Adapt
- 7:00Its time to bury traditional AppSec
- 7:16The old way
- 8:01Waterfall
- 8:28DevOps
- 11:20Bend
- 12:21Three Ways of DevOps
- 12:35Workflow
- 15:04AppSec Pipeline
- 15:54Key Features of AppSec Pipeline
- 17:58Optimizing is an Illusion
- 18:28Key Goals
- 20:02Intake
- 22:45Pipeline End
- 23:51Pipeline Visibility
- 25:36Work Flow
- 28:21Retest
- 30:19Practice
- 31:33Localization
- 32:10Improved Feedback
- 33:53Embracing Failure
- 35:20Findings Directly Into Bugs
- 36:17SLA
- 38:36Puppetsible
- 39:47Configuration Management Tools
- 40:17Post Employment Hook
- 41:52Turning Vulnerabilities And Its Head
- 42:59Automate
- 44:22Gauntlet
related talks
23mTrue DevSecOps with People, Processes, and Technologies
31mDevOps: You Build It, You Secure It
30mDevSecOps: More Than Just Pipelines
48mAppSec++ Take the best of Agile, DevOps and CI/CD into your AppSec Program
42mAppSec is dead. Long live DevSecOps!
39mDevOps: The Return of Security
38mDevOps Meet Sec: Your Journey To Delivering Secure Code Fast
32mHow to fit Sec into DevOps without Security team