Securing Your Web Application Pipeline From Intruders
summary
Argues that security belongs early and often in CI/CD and shows concrete integrations: run OWASP ZAP and static analyzers (arachne, burp, sqlmap) in the build phase, run dependency checks (retire.js, owasp dependency check) in test, and use manual audits or services (HackerOne, Signal Sciences, Threat Stack) before deploy. Shows actual configs for CircleCI, Conducto (no YAML) and Travis that install dependencies and run sneak test after build, with an option to fail the pipeline on high-severity findings. Emphasizes remove secrets from VCS, close open ports, patch libs, and revoke stale admin access.
AI-written summary · about
chapters (10)
- 0:00Intro
- 1:55Common Best Practices
- 5:00Why CI/CD security gets overlooked
- 8:09How intruders work
- 11:28Build Phase Tools
- 15:29Test Phase Tools
- 16:44Delivery Phase Tools
- 18:11Deploy Phase Tools
- 19:01Things You Can Do
- 25:26Key takeaways
related talks
42mContinuous Security: Integrate security tools into your DevOps Pipeline
39mSecurity Tooling in Your DevOps Pipeline
38mSecuring your CI/CD Pipeline
25mDecoupling DevSecOps from CI/CD Pipelines
26mBeyond Testing: Application Security in the Age of DevOps
07mInterview
44mSecurity Practices Useful in Agile Development
37mA Secure Continuous Delivery Pipeline