Battle Tested Application Security
summary
Shows that static analysis can spit out 50,000 static analysis findings and explains triage that narrows those to real vulnerabilities, maps pipelines like Concourse/Jenkins and Kubernetes for where to hook checks, and emphasizes building an asset inventory and perimeter monitoring so forgotten apps don’t explode. Says vendor silver bullets fail, recommends live coaching, contract language like the Software Security Annex, and swaps rigid 30/60/90 remediation rules for team‑specific SLAs—hygiene over hype.
AI-written summary · about
chapters (15)
- 0:00Intro
- 1:10How do you interview
- 2:15Learn your tech culture
- 4:10Dont take the upsell
- 5:42General approach
- 8:18Customer architecture
- 9:29Metrics
- 13:02Static Analysis
- 14:32Kaizen
- 16:29Waterfall Agile
- 18:33Team Composition
- 22:17Staffing
- 24:26Funding
- 27:50Asset Management
- 30:04Closing
related talks
54mA Shock to the System Static Analysis for Real AppSec
44mApplication Security: Everything we know is wrong
52mApplication Security at DevOps Speed and portfolio scale
53mLessons Learned: A Retrospective on Application Security Failures
26mBeyond Testing: Application Security in the Age of DevOps
53mPractical tips for web application security in the age of agile and DevOps
26mHow to Build an Application Security Program
45mApplication security loves Agile