Getting Security Up to Speed with CI - CD
Explore a 40-minute conference talk from LASCON 2015 that delves into integrating security practices with Continuous Integration and Continuous Deployment (CI/CD) processes. Learn how Samsung's OpenCloud team developed a Threadfix-Centric Application Security Architecture to automate security testing. Discover why traditional AppSec approaches need updating, how security testing differs from QA testing, and the considerations for building a security automation framework. Gain insights into Threadfix's role beyond being a security dashboard and understand the core components of effective security implementation. Additionally, find out how to leverage QA regression tests to enhance AppSec testing coverage. The talk covers topics such as threat modeling, challenges in implementation, creating accounts and applications, configuring scans, utilizing tools like Zap proxy, and managing defects and issues in the CI/CD pipeline.