Главная
Study mode:
on
1
Intro
2
Why Security DevOps?
3
Four different axes
4
Let's explore these axes
5
Axis of "Dynamic Depth"
6
Axis "Dynamic Depth": Level 1
7
ZAP in SecDevOps?
8
ZAP + Jenkins = SecDevOps?
9
BDD-Security in SecDevOps?
10
Gauntlt in SecDevOps?
11
Axis "Dynamic Depth": Level 2
12
Guide ZAP into Post-Auth in CI
13
Guide Arachni into Post-Auth
14
Guide BDD-Security into Post-Auth
15
Axis "Dynamic Depth": Level 3
16
Backend scans with ZAP
17
Backend scans with Arachni
18
Axis "Dynamic Depth": Level 4
19
ZAP with special workflows (2/3)
20
ZAP with special workflows (3/3)
21
BDD with special workflows
22
If no Selenium test code exists!
23
Axis of "Static Depth"
24
Axis of "Intensity"
25
Axis of "Consolidation"
26
Axis "Consolidation": Level 1
27
Axis "Consolidation": Level 2
28
Flagging builds from reports
29
Axis "Consolidation": Level 3
30
Axis "Consolidation": Level 4
31
Code coverage analysis
Description:
Explore security DevOps strategies for maintaining security in agile projects through this conference talk from AppSecEU 2015. Dive into four different axes of security implementation, including dynamic depth, static depth, intensity, and consolidation. Learn how to integrate tools like ZAP, Jenkins, BDD-Security, and Gauntlt into your CI/CD pipeline. Discover techniques for guiding security tools into post-authentication scenarios, conducting backend scans, and handling special workflows. Examine methods for consolidating security reports, flagging builds, and incorporating code coverage analysis. Gain insights on balancing security measures with agile development practices to ensure robust application security throughout the development lifecycle.

Security DevOps - Staying Secure in Agile Projects

OWASP Foundation
Add to list
0:00 / 0:00