AppSec is dead. Long live DevSecOps!
summary
Argues that traditional AppSec — slow reviews and standalone scanners — is dying and must be replaced by DevSecOps that embeds security into dev workflows (IDE, Jira, Slack, CI/CD). Cites surprising numbers: 1:100 security staffing ratio, 111 billion lines of code, and fixes cost ~30× more when done late. Recommends fast, nonblocking tests (aim for five-minute feedback), language-specific tools/training, measure deploy frequency and mean time to recover, and push “smart sharing” of fixes into code repositories.
AI-written summary · about
chapters (11)
- 0:00Introduction to the talk
- 3:55Why we still talk about security
- 9:58Cost of fixing vulnerabilities late
- 12:29Developer challenges in security
- 16:24What security people should do
- 19:31From waterfall to DevOps
- 23:50Embedding security in culture
- 29:54Automation in DevSecOps
- 33:49Measuring security effectively
- 36:13Smart sharing in DevSecOps
- 40:39Conclusion and Q&A
related talks
38mAppSec is Dead Long Live DevSecOps!
30mAppSec in a DevOps World
32mDevSecOps is Dead, Long Live DevSecOps
30mThe 3 Ways of DevSecOps – Making Shift Happen
45mLessons From DevOps: Taking DevOps Practices Into Your AppSec Life
27mSecurity Learns to Sprint: DevSecOps
47mSecurity is Everybody's Job
48mAppSec++ Take the best of Agile, DevOps and CI/CD into your AppSec Program