Standard Classification: Achieving Security by Shifting Left in Agile
summary
Claim: security belongs in the backlog as concrete stories with acceptance criteria, not as vague "examples." The process embeds STRIDE prioritization and security personas into epics, builds tests and a CI/CD pipeline using SAST DAST and pen testing (translating tool output into fixable tickets, demoed with a web app), and measures impact with real numbers — 100x cost to fix post-release and 266 days to contain a breach — showing early fixes are cheaper and verifiable.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:32About me
- 1:15Objectives
- 2:13Security breaches
- 4:37Cost of fixing vulnerabilities
- 5:37Penetration testing
- 6:49Bring in security elements into your life cycle
- 8:59Defining stories
- 13:10Modeling
- 14:35Design Encoding Principles
- 15:22Testing Strategy
- 16:39Code Reviews
- 20:09Putting it all together
- 22:29Balancing Act
- 23:45Risk Assessment
related talks
46mApplication Security in an Agile World
01h 04mShifting Security Everywhere
57mAgile Application Security
44mSecurity Practices Useful in Agile Development
40mMaking Security an integrated part of the SW Dev Lifecycle
29mPainless Agile Security
54mScaling Security in Agile Scrum
31mPrioritizing Trust while Creating Applications