DeepSec 2021 Talk: Running an AppSec Program in an Agile Environment – Mert Coskuner
Application security in an enterprise is a challenge. We can see this when we look at the statistics: There have been 16648 security vulnerabilities (CVEs) published so far in 2020 and the average severity is 7.1 out of 10. In this talk, you will find various solutions such as – Development team risk scoring based on maturity and business aspect, – SAST/DAST at CI/CD pipeline without blocking the pipeline itself, – How to leverage bug bounty program, – When to employ penetration testing, – When to employ code review, – Platform developments to remove dependency for developers to implement features, i.e. internal authorization. Most important of all, you will see these solutions lead to minimal friction within the team, which creates a fine-tuned security program. We asked Mert a few more questions about his