AppSec is Dead Long Live DevSecOps!
summary
A clear claim: one in three newly scanned apps has SQL injection and 22 years after discovery the bug still appears. Data points: 111 billion lines of code per year, roughly one security person per 100 developers, and fixes cost ~30× more late. Proposed fixes are concrete: integrate with IDE Slack CI/CD, provide language/framework training modules, capture and propagate real fixes via the pipeline, run fast coffee‑time scans in containers, and avoid blocking builds unless 100% certain. NASA’s high per‑line spending is cited as an effective precedent.
AI-written summary · about
chapters (12)
- 0:00Intro
- 2:30Why are we still talking about Secure Code
- 6:35Data
- 10:15Security Issues
- 16:00How to Create Secure Code
- 19:05How to Work Smarter
- 21:50DevSecOps Pillars
- 28:27Cultural Perspective
- 29:12Automation
- 32:26Measuring
- 34:56Sharing
- 37:02Conclusion
related talks
30mAppSec in a DevOps World
42mAppSec is dead. Long live DevSecOps!
30mThe AppSec Error Loop: How We Can Stop Repeating Common Security Mistakes
53mFlipping the Script on Application Security
40mNurture vs. Nature in AppSec: Data-Driven Measurement of DevSecOps
47mSecurity is Everybody's Job
13mIntelligence in AppSec: Use AI to supercharge DevSecOps
59mSecurity as Code: A DevSecOps Approach