Security DevOps - Staying Secure In Agile Projects

on YouTube ↗46m

" summary

Claims a reproducible CI pattern that finds low‑ and mid‑hanging security bugs automatically while freeing manual pentests for deep work, using OWASP ZAP (Jenkins plugin, REST API, auth session files, proxying), Arachni (JSON/XML passive capture + active scan), BDD‑Security/Gauntlet for scripted workflows and Selenium integration, and consolidation with ThreadFix and CodePulse. Scans run nightly and can take minutes to hours, build can be failed on high‑confidence results, and the approach deliberately does not replace manual pen testing.

AI-written summary · about

" chapters (31)

1. 0:00Intro
2. 0:58Why Security DevOps?
3. 3:32Four different axes
4. 4:47Let's explore these axes
5. 5:21Axis of "Dynamic Depth"
6. 5:48Axis "Dynamic Depth": Level 1
7. 6:28ZAP in SecDevOps?
8. 7:07ZAP + Jenkins = SecDevOps?
9. 11:18BDD-Security in SecDevOps?
10. 13:56Gauntlt in SecDevOps?
11. 15:20Axis "Dynamic Depth": Level 2
12. 16:12Guide ZAP into Post-Auth in CI
13. 20:23Guide Arachni into Post-Auth
14. 22:32Guide BDD-Security into Post-Auth
15. 24:42Axis "Dynamic Depth": Level 3
16. 26:13Backend scans with ZAP
17. 28:07Backend scans with Arachni
18. 29:23Axis "Dynamic Depth": Level 4
19. 30:11ZAP with special workflows (2/3)
20. 33:52ZAP with special workflows (3/3)
21. 34:23BDD with special workflows
22. 34:57If no Selenium test code exists!
23. 36:00Axis of "Static Depth"
24. 36:33Axis of "Intensity"
25. 36:53Axis of "Consolidation"
26. 37:10Axis "Consolidation": Level 1
27. 38:09Axis "Consolidation": Level 2
28. 38:37Flagging builds from reports
29. 39:20Axis "Consolidation": Level 3
30. 40:08Axis "Consolidation": Level 4
31. 40:29Code coverage analysis

" related talks

• 46mMaking Security AgileOleg Gryb, Saniay Tambe · OWASP AppSec California 2016
• 44mSecurity Practices Useful in Agile Developmentaki matsuno · Regional Scrum Gathering Tokyo 2024
• 42mContinuous Security: Integrate security tools into your DevOps PipelineBill Dinger · Build Stuff 2020
• 43mBuilding a Secure DevOps PipelineAaron Weaver · AppSec USA 2017
• 52mApplication Security at DevOps Speed and portfolio scaleJeff Williams · AppSec California 2014
• 01h 18mDevSecOps - Automating Security in DevOpsAnand Tiwari · DevOpsDays Boston 2019
• 45mAutomated Security Testing in a DevOps worldKevin Wittek · Greach 2019
• 39mSecurity Tooling in Your DevOps PipelineNancy Gariché · NDC Oslo 2020