Lessons Learned: A Retrospective on Application Security Failures
summary
Argues that consolidating into Application Security Posture Management beats stitching SCA SAST secret and container scanners from many vendors, shows a live migration that adds CSPM + ASPM checks into CI CD pipelines, surfaces 100+ secret findings from repos, and builds blocking guardrails via control tower SCPs tagging and auto‑remediation templates that break unsafe builds. Describes a Python EOL notifier and reports the retrofit takes about 9–10 months to reach non‑prod stability then roll into production.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:05Speaker journey
- 3:52Choosing security tooling
- 8:13Multiple security vendors
- 10:05Application Security Posture Management
- 11:52Tooling selection mistakes
- 15:06Rolling out security program
- 19:21Developer training and threat modeling
- 21:30Eliminating bug classes
- 24:58Reactive to proactive security
- 28:36Key takeaways
- 32:30Securing cloud-native apps
- 35:47Shift left in security
- 44:09Future of app security
- 45:57Q&A
related talks
33mBattle Tested Application Security
40mDevSecOps Guide to Bulletproof Your Development Workflow
01h 04mShifting Security Everywhere
50mThe Application Security State of the Union
46mApplication security from start to finish
49mLessons from DevSecOps Trenches
52mApplication Security at DevOps Speed and portfolio scale
27mSecurity Learns to Sprint: DevSecOps