Application Security in an Agile World
summary
Argues for embedding security into Agile workflows so teams ship at DevOps speed, using Jira issues instead of 100‑page PDFs, tagging security stories and adding security acceptance criteria to user stories. Recommends pairing, code reviews, unit tests, and CI-triggered static and dynamic scans (Brakeman, Burp, bdd-security, Gauntlet) against containerized feature branches. Uses a security burndown metric and case studies where an allocated pre-release security month disappears as security work is absorbed into sprints.
AI-written summary · about
chapters (23)
- 0:00Introduction
- 3:35Application Security
- 4:46Penetration Testing
- 8:55DevOps Security
- 9:47General Hygiene
- 11:59Relative Costs
- 12:46Secure Scrum
- 13:25Security Training
- 15:12Security Requirements
- 18:05Requirements
- 18:54Coding
- 21:06Unit Tests
- 21:20Acceptance Criteria
- 22:30QA
- 23:36Security Hard
- 24:24Security Depth Burndown
- 26:30DevOps
- 28:01Application Production
- 31:02Unicorn Sauce
- 31:23Lets work together
- 31:41Whats next
- 31:53Summary
- 33:28Questions
related talks
57mAgile Application Security
54mScaling Security in Agile Scrum
29mPainless Agile Security
44mSecurity Practices Useful in Agile Development
27mStandard Classification: Achieving Security by Shifting Left in Agile
13mAgile in Security and Security in Agile
45mAgile Security Testing - Lessons Learned
40mMaking Security an integrated part of the SW Dev Lifecycle