Practical tips for web application security in the age of agile and DevOps
summary
Claims concrete tactics: adapt heavyweight static analysis to start bottom-up by onboarding one vulnerability class (example: command execution) and run checks on every commit; repurpose scanners for policy/headers and regression tests rather than broad discovery; treat bug bounties and targeted pentests as complementary; centralize logs and alerts for continuous feedback and visibility so teams detect attackers earlier in the attack chain and measure maturity by detection and time-to-response, not checklists.
AI-written summary · about
chapters (29)
- 0:00Intro
- 0:46Zanes background
- 2:09What is this talk about
- 3:35Clich alert
- 4:14Changes in DevOps
- 7:34Security is no longer outsourced
- 8:25Waterfall security methodology
- 8:36Core components
- 9:09What pieces of this needs to change
- 10:08Static analysis
- 10:34Traditional static analysis
- 11:35How to adapt
- 13:24Command execution
- 19:45hashing encryption
- 21:44proactive alerting
- 23:58scanning
- 24:37Dynamics gaming
- 26:01Cheap use cases
- 29:46Legacy visibility
- 30:42Building effective visibility
- 34:24Feedback legacy
- 35:07Bounties
- 40:28The hallmark of modern app tech
- 40:50Attack driven defense
- 42:14Work your way back
- 46:55Data forensics
- 48:53Etsy example
- 50:16Closing thesis
- 51:36Questions
related talks
27mBridging the Dev-Sec divide: Three tips for agile developers
45mApplication security loves Agile
52mApplication Security at DevOps Speed and portfolio scale
46mApplication Security in an Agile World
47mSecurity is Everybody's Job
26mBeyond Testing: Application Security in the Age of DevOps
57mAgile Application Security
37mHow to get developers to want to adopt AppSec