Security is Everybody's Job
summary
Claim: security becomes everyone’s job by wiring AppSec into the three DevOps ways — efficiency, fast feedback, continuous learning — not by vague exhortations. Concrete moves: tune SCA and DAST tools (Bright, ZAP, Burp), put findings into the bug tracker, run CI/CD scans, reuse pre-scanned images and a secure code library, teach secure coding. Surprising numbers: a staffing 100/10/1 ratio and defect costs rising from ~$80 to ~$7,600 across stages motivate shift left and shorter lead times so vulnerabilities get fixed quickly.
AI-written summary · about
chapters (6)
- 0:00Start
- 17:15Way #1: Emphasize the efficiency of the entire system
- 21:51What does this mean for dev & ops?
- 25:33What does this mean for developers?
- 35:24What does this mean for Security?
- 38:08What does this mean for ops?
related talks
30mAppSec in a DevOps World
31mTopics of Interest: Scaling AppSec through Education
01h 04mShifting Security Everywhere
40mDevSecOps Guide to Bulletproof Your Development Workflow
34mDevSecOps: How to Use DevOps to Make You More Secure
38mDevOps Meet Sec: Your Journey To Delivering Secure Code Fast
26mBeyond Testing: Application Security in the Age of DevOps
31mDevOps: You Build It, You Secure It