What’s in an AppSec program?
summary
Builds an AppSec program from scratch for a ~35‑developer shop with containerized CI on Bamboo, automating SAST, SCA and DAST into a pipeline and feeding findings into DefectDojo → JIRA for triage. Uses SonarQube + FindSecBugs for code scans, Dependency‑Check and a Dependabot‑style prototype for components, and ZAP + Selenium for nightly DAST. Leads to secrets‑management work after a hardcoded‑IV finding, nightly regression scans, suppression automation, monthly vulnerability reviews, CTFs, and a reduction in median fix time from months to about three–four working days.
AI-written summary · about
chapters (9)
- 0:00Start
- 14:35Program Objectives
- 16:52AppSec Pipeline
- 34:48DAST
- 38:31Dealing with Noise
- 41:13Security Requirements
- 49:55Coding Standards
- 51:12Share Knowledge
- 53:39Lessons Learned
related talks
48mAppSec++ Take the best of Agile, DevOps and CI/CD into your AppSec Program
33mJumpstarting Your Appsec Program
08mRunning an Appsec Program with Open Source Projects"
46mBuilding An AppSec Pipeline: Keeping Your Program, And Your Life, Sane
26mHow to Build an Application Security Program
28mData-Driven AppSec Champions Programs – Benchmarking Your Program with Numbers
57mKeynote: Maturing Your Application Security Program
43mBuilding a Secure DevOps Pipeline