Agile in Security and Security in Agile
summary
Banking teams add a dedicated evil engineer role and pair each feature story with an "evil story" that tries to break it, use the OWASP Top Ten and the Security Knowledge Framework for concrete vulnerabilities and hands‑on labs, and automate OWASP ZAP scans via a Jenkins plugin so scans run against an immutable build. Active scans sometimes crash environments, so rules get tuned and reports feed human pen testers; practice proves the approach shortens feedback and raises baseline security.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 1:48Evil Engineers
- 3:36Backlog
- 5:56Security Knowledge Framework
- 7:37Whats next
- 8:26Zetas
- 9:46Jenkins
related talks
46mApplication Security in an Agile World
57mAgile Application Security
54mScaling Security in Agile Scrum
44mSecurity Practices Useful in Agile Development
45mAgile Security Testing - Lessons Learned
46mSecurity DevOps - Staying Secure In Agile Projects
45mApplication security loves Agile
29mPainless Agile Security