Building An AppSec Pipeline: Keeping Your Program, And Your Life, Sane
summary
Case study of an AppSec pipeline that actually ships: a three‑month MVP called Bag of Holding (Python/Django) holds inventory and engagements, orchestrates scans (IBM AppScan, ZAP, Checkmarx), funnels results into ThreadFix and Jira, and uses stackstorm plus a HipChat bot for automation. Manual assessments drop from weeks to scheduled slots, draft reports generate in ~0.7s, ThreadFix handles deduping, and the system is being open‑sourced — it works in production.
AI-written summary · about
chapters (43)
- 0:00Introduction
- 0:42Fast Food
- 1:33Instrumentation
- 3:15AppSec Fast Food
- 4:08AppSec Pipeline
- 4:40What does your front door look like
- 5:19Google Form
- 5:42Minimal Viable Product
- 7:30Team Choice
- 8:10Python
- 8:31Bag of Holding
- 8:49What does BO do
- 12:09The Goal
- 13:44Metadata
- 14:13Tag
- 14:32Pending Engagement
- 15:58Environment Details
- 16:30Related People
- 17:06Commenting
- 18:15Search By Application
- 18:46Length Of Activities
- 19:50Stories
- 20:16Social Feed
- 21:38Tooling Vendors
- 22:27API
- 22:53UI API
- 23:27Workflows
- 24:29Generic API
- 25:33Scanning
- 25:53Automation
- 26:51Assessment Schedule
- 30:32AppSec Bot
- 32:04ThreadFix Example
- 32:52Checkmarks Example
- 33:38Make AppSec Work
- 34:43Open Source
- 35:24Response Time
- 37:08Developers
- 38:35Security Requirements
- 39:55Automatic Retests
- 41:22Deployment Experience
- 43:24Threat Fixjira Integration
- 44:38Deduping
related talks
51mTaking AppSec to 11: Pipelines, DevOps and making things better
48mAppSec++ Take the best of Agile, DevOps and CI/CD into your AppSec Program
57mWhat’s in an AppSec program?
43mBuilding a Secure DevOps Pipeline
42mMaking Continuous Security a Reality with OWASP’s AppSec Pipeline
15mInterview with
36mCreating an AppSec Pipeline with Containers in a Week
46mMaking Security Agile