Penetration Testing in the Release Pipeline
summary
Frameworks and tools are integrated into the pipeline so security checks run nightly and give actionable failures: BDD-Security drives OWASP ZAP, SSLyze, Arachne and Selenium to test APIs and UIs, scans average 20–30 minutes, and results appear as JUnit/HTML reports in CI. Teams spin up per-feature AWS environments from TeamCity/Ansible, tag scenarios, and treat findings as defects, which reduces release risk and keeps throughput above the 450 req/s target (often 750–800).
AI-written summary · about
chapters (13)
- 0:00Start
- 2:40Training Opportunities
- 3:34Static and Dynamic Security Scanning
- 4:12Software Development Lifecycle
- 7:29Technical Details
- 8:21Selenium
- 12:21Results
- 14:31Gauntlet Framework
- 17:33Non Functional Testing
- 18:08Continues To Review Pipeline
- 20:25Local and Feature Build Environment
- 25:53Feature Team Responsibilities
- 29:32Summary
related talks
46mSecurity DevOps - Staying Secure In Agile Projects
46mMaking Security Agile
39mSecurity Tooling in Your DevOps Pipeline
42mTest Driven Security in the DevOps pipeline
42mContinuous Security: Integrate security tools into your DevOps Pipeline
29mSecuring Your Web Application Pipeline From Intruders
43mBuilding a Secure DevOps Pipeline
19mApplication Security at High Velocity