Taking AppSec to 11: Pipelines, DevOps and making things better
summary
Claims a practical pipeline that raises yearly assessments from ~44 to ~200 while losing ~3.5 staff and peaking at a 12‑person team, using automation and orchestration rather than handcrafted testing. Built an open source Django intake called Bag of Holding, a HipChat bot and TF client, wires StackStorm orchestration to scanners (Checkmarx Veracode Burp ZAP Qualys) and pushes normalized findings into ThreadFix single source of truth and JIRA, producing a 40% decrease in time to fix and far higher consistency.
AI-written summary · about
chapters (33)
- 0:00Intro
- 0:30Silver Lining
- 1:05Handcrafting
- 2:09Spinal Tap
- 2:39Work Hallelujah
- 3:37Workflow
- 3:54Flow
- 4:21Workflows
- 5:47Custom but fast
- 6:24AppSec Pipeline
- 6:56Knapsack Pipeline
- 8:43Reusable Path
- 16:18AppSec QA
- 22:27Optimizing AppSec
- 25:27App Types
- 26:50Risk System
- 31:12Automated Tools
- 32:45Threadfixes
- 33:51Work in progress
- 38:42Assessments
- 41:44Team Dashboard
- 42:10Application Repository
- 42:37Application Status
- 42:52Defect Dojo
- 43:18Upstream and downstream information
- 43:59Python Bob
- 45:20Checkmarks
- 46:45Experimentation
- 47:05The Curve
- 47:20Manual Assessment
- 47:43Oh Snap Sec Pipeline
- 48:18Tool Integrations
- 48:40Absolute Pipeline Toolbox
related talks
46mBuilding An AppSec Pipeline: Keeping Your Program, And Your Life, Sane
43mBuilding a Secure DevOps Pipeline
48mAppSec++ Take the best of Agile, DevOps and CI/CD into your AppSec Program
45mLessons From DevOps: Taking DevOps Practices Into Your AppSec Life
27mStandard Classification: Automate Security, Don't Tell Your Boss
59mDevOps for the Discouraged
29mReducing the "Oops Factor": Pipelines for a Secure Python Development Lifecycle
42mMaking Continuous Security a Reality with OWASP’s AppSec Pipeline