Shift Left Security with the Security Test Pyramid
summary
Argues for concrete security checks at every pyramid layer and shows working demos: a purposely vulnerable bookmark app, unit and ArcUnit tests that catch missing method-level authorization and SQL injection, and CI scans with SonarQube and SpotBugs plus dependency SCA/npm audit. Demonstrates integration tests that reproduce SQLi, enforces ASVS password rules (12+ chars), and runs dynamic scans with ArcUnit architecture tests and OWASP ZAP baseline vs full scans. Recommends automating static, SCA, image, and API scans in pipeline.
AI-written summary · about
chapters (5)
- 0:00Start
- 4:49The Testing Pyramid Gregory
- 15:13Static Application Security Testing
- 18:29V2: Authentication
- 39:16Dynamic Application Security Testing
related talks
44mShift-Left-Security with the Security Test Pyramid
37mDeploying Security Testing Practice in Your Team and Company
42mContinuous Security: Integrate security tools into your DevOps Pipeline
06mInterview with
01h 04mShifting Security Everywhere
39mAutomating Your Security Checks: Stop Hiding Your Flaws Next to the Monsters...
44mSecurity Practices Useful in Agile Development
29mSecuring Your Web Application Pipeline From Intruders