Continuous Security testing is becoming more and more a key factor for success. Especially if we consider that the development and release process is speeding up enormously. Just imagine that your potential shippable product is going to production with a huge vulnerability or a back door open. The damage to your company and bad reputation would be even not measurable.
So how can we avoid this? How can we build- security -in? Let's leave the stone age behind, break down the security silo. In my talk I will show you how the four fists get implemented in your DevSecOps team and how they will improve your product's quality! 

Target Audience: Testers, Developers, Product Owner, decision makers
Prerequisites: none
Level: Advanced

Extended Abstract:
Continuous Security testing is becoming more and more a key factor for success. Especially if we consider that the development and release process is speeding up enormously. Just imagine that your potential shippable product is going to production with a huge vulnerability or a back door open. The damage to your company and bad reputation would be even not measurable.
So how can we avoid this? How can we build- security -in? Let's leave the stone age behind, break down the security silo and implement DevSecOps.

During my talk, I will tell you where you can implement and improve security testing. What different kinds of functional and non-function security testing methods are available and what are the low-hanging fruits.
On a high level, I will explain SAST / DAST / IAST / RASP and how your team could implement these methods with examples. Then I will lift it to the next level and show how you can add
security testing to your pipeline to get fast feedback to fix the vulnerabilities at a very early stage (shift left). By showing where to implement security tests in your software development lifecycle, I will explain where it makes sense
to have security as a deep skill part of your team and go for DevSecOps!

After I increased our transparency of security and showed you how to deal with 'the four fists', I will close my talk by presenting the 10 successful steps to DevSecOps.