The increasing speed of mobile releases makes traditional security a bottleneck, requiring a shift-left approach to find and fix bugs early in the development cycle.
Mobile DevOps combines people, processes, and tools to enable continuous communication, integration, delivery, testing, and monitoring for mobile applications.
DevSecOps extends DevOps by making security a shared responsibility and integrating automated security checks throughout the entire development process.
Implementing DevSecOps involves choosing between static (SAST), dynamic (DAST), and interactive (IAST) security testing tools to automate vulnerability detection.
A practical DevSecOps workflow for Android includes steps for static analysis, dependency scanning, dynamic testing, and vulnerability scanning at different stages.
A live demonstration shows how to configure a mobile CI/CD pipeline in Bitrise with integrated steps for SonarQube, Firebase Test Lab, and Oversecured API.
Implementing DevSecOps is a continuous journey that requires a cultural mindset shift, shared team responsibility, and a strong foundation in test automation.
The speaker answers audience questions about balancing speed with security, convincing management to adopt DevSecOps, and common security leaks in mobile development.
16:00Ali Yazdani
33:20Aarno Aukia
43:31Nachiket Apte
44:30Milecia McGregor
51:13Thomas Fuchs, Waleed Arshad & Frank Dornberger & Idir Ouhab Meskine:
26:50Nazneen Rupawalla
44:40Christoph Ruggenthaler
34:44Majid Hajian
Jobs that call for the skills explored in this talk.
GULP Information Services GmbH
NTT DATA Deutschland GmbH
NTT DATA Deutschland GmbH