Seven Security Sins: the seven biggest Security Problems of agile Projects
summary
Lists seven concrete failure modes in agile projects and shows how each is found and fixed: whiteboard threat modeling with the Microsoft Threat Modeling Toolkit, backlog “evil user stories,” concrete OWASP ZAP and SAST/DAST/IAST setups in CI, dependency and secret-scanning (dependency-check, git-secrets), vaults and JWT identity propagation, crypto rules (use GCM not ECB/CBC), CIS/Docker hardening checks, regular pen tests, defined security roles, SIEM/logging and breach drills. Expect actionable demos, tool names, and exact remediation steps rather than vague advice.
AI-written summary · about
chapters (21)
- 0:00Intro
- 2:54Threat Modeling Are you doing it?
- 6:17Hacking the Backlog
- 8:44Security Requirements
- 11:30Benchmark Yourself
- 14:09Crypto
- 22:34Identity Propagation
- 25:42Hardening
- 29:28Secure Config
- 31:14Secure Coding
- 33:04Protection Headers
- 34:15Application Security Scans
- 40:12Dependency Management
- 42:38Secret Leakage Prevention
- 47:16Security role in every team
- 49:44Process & Responsibility
- 50:35Security Information Hub
- 52:11Audience Targeting
- 53:16Knowing Your Enemy
- 56:06Logging & Monitoring
- 59:21Incident Simulation Drills
related talks
44mSecurity Practices Useful in Agile Development
13mAgile in Security and Security in Agile
01h 04mShifting Security Everywhere
57mThe Developer's Field Guide to Software Security
29mDevSecOps: Five Common Mistakes
46mApplication Security in an Agile World
44mShift-Left-Security with the Security Test Pyramid
29mPainless Agile Security