Interview with
summary
Argues for baking security into every phase of development rather than leaving it to the end, with concrete practices: extract requirements from OWASP ASVS and the Top 10 to generate tests, run IDE plugins in IntelliJ/Eclipse/Visual Studio while coding, use a developer sandbox for module-level checks, then enforce full static analysis in CI (Jenkins) and optional predeploy dynamic scans with OWASP ZAP, and combine with Selenium for functional security tests; notes US customers adopt this earlier than many European teams.
AI-written summary · about
related talks
37mDeploying Security Testing Practice in Your Team and Company
57mThe Developer's Field Guide to Software Security
44mShift-Left-Security with the Security Test Pyramid
57mShift Left Security with the Security Test Pyramid
45mBringing Security Testing To Development: How To Enable Developers To Act As Security Experts
29mSecuring Your Web Application Pipeline From Intruders
44mStart writing security tests now!
26mBeyond Testing: Application Security in the Age of DevOps