Interview with
summary
AppSec now covers web, APIs and IoT and focuses on keeping company data private and avoiding breaches; typical staffing is tiny—ops to dev ~2:1 and 100 to 1 security:developers—so teams go distributed, rely on synchronous chat plus ad‑hoc video hangouts, and shift left into product sprints. Practical tooling and automation include Slack/HipChat/IRC for presence, OWASP ZAP as a headless proxy for CI/CD, Gauntlet and the OWASP AppSec Pipeline to push scanning into build pipelines, and the community movement I am the calvary.
AI-written summary · about
chapters (8)
- 0:00What is AppSec
- 1:18Managing AppSec Teams
- 3:11Dispersed Teams
- 3:44Video Conferencing
- 5:06Staggering
- 5:58App security
- 9:33DevOps mindset
- 11:30What projects are you following
related talks
42mAppSec is dead. Long live DevSecOps!
48mAppSec++ Take the best of Agile, DevOps and CI/CD into your AppSec Program
29mAppSec on a budget
52mApplication Security at DevOps Speed and portfolio scale
46mBuilding An AppSec Pipeline: Keeping Your Program, And Your Life, Sane
47mSecurity is Everybody's Job
33mWhy Developers Struggle with API Security
57mWhat’s in an AppSec program?
