Agile Application Security
Authors: Laura Bell, Michael Brunton-Spall, Rich Smith, Jim Bird
Publisher: O'Reilly Media
Length: 2017
Laura Bell, Michael Brunton-Spall, Rich Smith, and Jim Bird on embedding security practices, roles, and automation into agile delivery and CI/CD.
Original
TranslationBrief
The essential idea
Agile Application Security connects developers and traditional security specialists by treating security as part of the development system rather than a separate inspection after implementation. The book establishes a shared language for agile and security and integrates security requirements, threat modeling, risk management, secure design and review, testing, CI/CD, secrets, monitoring, and incident response into normal product work.
Its strongest organizational principle is pull rather than push: security should enable teams, make risks and controls transparent, investigate causes instead of blaming people, and scale expertise through tooling and distributed capability. Compliance may prescribe controls or focus on outcomes, but either way it must be part of a coherent security culture rather than a ceremonial final gate.
Decision lens
Key takeaways
Security in agile delivery cannot remain a separate control phase after development.
Developers and security specialists need a shared understanding of agile, CI/CD, risks, and operational responsibility.
Security requirements and threat models belong in problem framing and design, not only in testing.
Code, infrastructure, pipelines, secrets, monitoring, and incidents are all part of the application security surface.
Enabling teams through transparent practices and automation works better than a prohibition-first culture.
Compliance is sustainable when rules and outcome measures support the engineering process rather than interrupt it.
Workplace experiment
Apply it at work
- 1
Add security and privacy quality attributes to the next initiative's requirements before design starts.
- 2
Run a lightweight threat-modeling session and record mitigations, owners, and residual risks.
- 3
Automate one security check in CI/CD while documenting how engineers can resolve or appeal failures.
- 4
Review secrets handling, pipeline permissions, monitoring, and incident response as one operational system.
- 5
Replace one blocking security gate with guidance, tooling, or an enabling-team engagement that builds product-team capability.
Choose one action, define the observable effect, and keep the first test small enough to reverse.
Evidence
Sources and further reading
Additional sources
Channel, aggregator, and commentary links confirm the work; they are not the primary source.