Continuous Security
summary
Argues concrete steps to make security part of the pipeline: use STRIDE threat modeling and security personas to drive stories, run OWASP ZAP (headless) or gauntlet via BDD-Security for automated tests, add dependency checks and vulnerability scanners at build time, and monitor with SSL Labs and Docker Bench. Cites hard numbers: average breach discovery 287 days, 162 security pros (35 pentesters) in New Zealand, eight months to hire, and 675 Gbps as a real DDoS peak to design for.
AI-written summary · about
chapters (40)
- 0:00Intro
- 0:48Im not just a consultant
- 1:36We are not perfect
- 2:10Youre the wrong conference
- 2:42Dream state
- 3:18Security is really freaking hard
- 3:47Why we became developers
- 4:17Lets build the dream
- 4:54People take security seriously
- 5:34Whats in this talk
- 6:57Common misconceptions
- 8:12Web Application Firewall
- 10:45Compliance
- 11:10What is Continuous Security
- 11:41What is Software
- 12:03What is Security
- 12:39Choose Your Own Adventure
- 13:21Principles of Getting There
- 13:44Boring jobs
- 14:28Things to automate
- 15:20Autonomous
- 16:19accountability
- 16:57integration
- 17:45repeatable
- 18:24work together
- 18:38finally scalable
- 19:22we need to take it
- 20:18lets start with design
- 20:32Security persona
- 25:52Threat assessment
- 27:46Design
- 30:24Testing
- 31:14Getting started
- 34:13Things you can do
- 38:09DevOps Defensive Toolkit
- 38:38SSL Labs
- 40:43What happens when your company gets this
- 45:06Preparing for incidents
- 47:05Safety
- 49:16Questions
related talks
47mSecurity is Everybody's Job
42mContinuous Security: Integrate security tools into your DevOps Pipeline
01h 03mBe your own Threatbuster!
29mSecuring Your Web Application Pipeline From Intruders
58mHow to embed security into your process
31mDevOps: You Build It, You Secure It
27mBridging the Dev-Sec divide: Three tips for agile developers
40mMaking Security an integrated part of the SW Dev Lifecycle