How to Effect Change in the Epistemological Wasteland of App Security
summary
Application security shifts from lectures to engineering: defend with integrated rugged testing inside CI pipelines using Gauntlet (Cucumber-based) and scanners like Arachni, run tests in Jenkins/Travis, and convert logs to metrics with Logstash -> statsd for application security telemetry. Organizations show skewed staffing (hundreds of devs to a few security people) and that gap drives blindspots. Harden infrastructure with config management and Chef audit, and use runtime monitoring (Threat Stack, Signal Sciences) to close the loop.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 0:12How to effect change in the Epistemological Wasteland of Application Security
- 1:54SUMMARY
- 3:59EPISTEMOLOGICAL PROBLEM OF SOFTWARE DEVELOPMENT
- 5:32TLDR; RAPID ITERATIONS WIN
- 5:52THE WORLD HAS CHANGED SINCE AGILE
- 6:26DEVOPS IS THE APPLICATION OF AGILE METHODOLOGY TO SYSTEM ADMINISTRATION -THE PRACTICE OF CLOUD SYSTEM ADMINISTRATION BOOK
- 6:44AGILE INFRASTRUCTURE
- 11:21SEPARATION OF DUTIES CONSIDERED HARMFUL
- 11:54REDUCE CODE LATENCY INCREASE CODE VELOCITY
- 17:49INTEGRATED RUGGED TESTING SHOULD SIT INSIDE THE PIPELINE
- 24:32PUT SECURITY TESTING IN YOUR CONTINUOUS INTEGRATION SYSTEM
- 25:27ADD APPLICATION SECURITY TELEMETRY TO DEVS AND OPS
related talks
47mSecurity is Everybody's Job
26mBeyond Testing: Application Security in the Age of DevOps
01h 04mTransformation Blueprint for Developer-Centric Application Security
57mBuilding a Modern Security Engineering Organization
53mPractical tips for web application security in the age of agile and DevOps
31mTopics of Interest: Scaling AppSec through Education
52mApplication Security at DevOps Speed and portfolio scale
27mDevelopers Struggle with Application Security (and How to Make ...)