Deploying Security Testing Practice in Your Team and Company
summary
Argues for actionable steps: prioritize OWASP Top Ten with injection remains number one, use concrete tools like SQLMap steals DB schemas and Burp Suite or OWASP ZAP plus SonarQube and dependency-check for SCA, run proxies against Selenium tests and in CI to catch regressions, adopt ASVS and SAM as measurable standards, avoid once‑a‑year consultants (one day of testing leaves 364 days vulnerable), bake security into the Definition of Done with a JIRA security verified field and use checklists for repeatable validation.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:04Security testing matters
- 3:13Growth in security testing
- 5:22Start security testing
- 7:55Drivers for security testing
- 10:01Organizing security testing
- 12:34Frameworks and dependencies
- 15:50When to test security
- 18:39Security in definition of done
- 20:25OWASP guidance
- 22:34SAMM and ASVS standards
- 25:47Top OWASP vulnerabilities
- 27:30Security testing tools
- 30:42Integrating security automation
- 32:25Challenges in adoption
- 35:14Learning security testing
related talks
06mInterview with
26mBeyond Testing: Application Security in the Age of DevOps
44mShift-Left-Security with the Security Test Pyramid
57mThe Developer's Field Guide to Software Security
27mHow to Start Security Testing Without Fear
57mShift Left Security with the Security Test Pyramid
44mSecurity Practices Useful in Agile Development
23mWeb Application Security - owasp top 10 vulnerabilities