Ah mom, why do I need to eat my vegetables?
summary
Argues that application security succeeds only when integrated into Agile/DevOps with measurable practices: start with an OpenSAM baseline, compute inherent risk by combining data classification and attack surface, prioritize high‑risk apps, and pair broad automated scans with deep manual reviews plus a continual feedback loop. Shows workarounds for legacy apps, advocates reference architectures, training, CI sensors and a mapped expected model, cites many programs and frequent incident‑driven funding, and reports improved coverage and falling risk when developers collaborate.
AI-written summary · about
chapters (38)
- 0:00Introduction
- 1:19Johns background
- 2:33Family
- 4:48What is SDLC
- 5:42Goal of a Knapsack Program
- 6:16Knapsack Program Components
- 8:53Executive Sponsorship
- 11:04Develop a Hammer
- 12:30Know Your Baseline
- 13:40Maturity
- 15:59Build the bridge
- 17:02Eat your own policy
- 18:19Application portfolio
- 20:57What do we expect
- 21:49Testing
- 23:01What is secure
- 23:19What defines secure
- 24:36Authorization
- 26:13Architecture Reference
- 28:06Training and Awareness
- 29:11Chris Romeo
- 31:13Security activities
- 32:22Security integration strategies
- 34:00Maturity path
- 34:38Waterfall SDLC example
- 36:11Scale
- 37:57Continuous Improvement
- 38:42Know Your Tools
- 39:16Benchmark OS
- 40:18Integration Model
- 40:31Continuous Integration Model
- 41:23The Future of DevOps
- 42:02Distribution
- 42:50Team Expansion
- 46:04Vulnerability Analysis
- 46:54Best Practices
- 47:58Summary
- 49:18Questions
related talks
45mApplication security loves Agile
53mPractical tips for web application security in the age of agile and DevOps
38mPrioritizing Trust While Creating Applications
46mJuggling the Elephants: Making AppSec a Continuous Program
57mAgile Application Security
47mSecurity is Everybody's Job
57mKeynote: Maturing Your Application Security Program
17mWhy you fail at Application Security - and how to fix it