Skillful, Scalefull Fullstack Security in a State of Constant Flux
summary
Argues that automation (Selenium, Burp/ZAP, CI hooks, Jenkins) finds the routine XSS/SQLi stuff while humans focus on business logic, component management and patching, because 63% of vulnerabilities are not developer‑written issues. Recommends continuous asset profiling, immutable cloud instances, and component scanning, and shows Delta analysis that compares runs so only new or changed findings need human review, cutting analyst workload from hundreds to a handful and making full‑stack security scalable.
AI-written summary · about
chapters (14)
- 0:00Start
- 6:39Market Driven Approaches to a Market Driven Problem
- 8:14Convergence Developer Security
- 9:59Divergence Application Security Industry
- 13:39Continuous Security Keeping up with development Assisting secure deployment
- 21:31Automation!!
- 22:16Automation and integration
- 26:43Fighting The Anti-Scale
- 28:36SAST integration
- 30:54DAST Tool/Runtime Vulnerability Management - Pitfalls
- 31:20Vulnerability Assessment (Host)
- 32:01Component Security
- 32:20Delta Metrics
- 33:57Continuous Asset Profiling Detect Global Estate Changes
related talks
44mApplication Security: Everything we know is wrong
46mRugged Software Engineering
39mAutomating myself out of a job...
52mContinuous Security
47mSecurity is Everybody's Job
52mApplication Security at DevOps Speed and portfolio scale
33mBattle Tested Application Security
46mSecurity DevOps - Staying Secure In Agile Projects