Mark S. Merkow, CISSP, CISM, CSSLP, works at WageWorks in Tempe, Arizona, leading application security architecture and engineering efforts in the office of the CISO. Mark has over 40 years of experience in IT in a variety of roles, including application development, systems analysis and design, security engineering, and security management. Mark holds a Master of Science in Decision and Information Systems from Arizona State University (ASU), a Master of Education in Distance Education from ASU, and a Bachelor of Science in Computer Information Systems from ASU. In addition to his day job, Mark engages in a number of extracurricular activities, including consulting, course development, online course instruction, and book writing. Mark has authored or co-authored 17 books on IT and has been a contributing editor to four others. Mark remains very active in the information security community, working in a variety of volunteer roles for the Phoenix Chapter of (ISC)2®, ISACA®, and OWASP. You can find Mark’s LinkedIn® profile at: linkedin.com/in/markmerkow

Modern software development breaks the old ways of security. This book is practical, actionable, relatable, and most importantly, current. It should be required reading for all Agile and DevOps teams.—Ed Adams, Chief Executive Officer, Security Innovation, Inc.

• DedicationContentsPrefaceAbout the AuthorChapter 1: Today’s Software Development Practices Shatter Old Security PracticesChapter 2: Deconstructing Agile and ScrumChapter 3: Learning Is FUNdamental!Chapter 4: Product Backlog Development—Building Security InChapter 5: Secure Design ConsiderationsChapter 6: Security in the Design SprintChapter 7: Defensive ProgrammingChapter 8: Testing Part 1: Static Code AnalysisChapter 9: Testing Part 2: Penetration Testing/Dynamic Analysis/IAST/RASPChapter 10: Securing DevOpsChapter 11: Metrics and Models for AppSec MaturityChapter 12: Frontiers for AppSecChapter 13: AppSec Is a Marathon—Not a Sprint! Appendix A: Sample Acceptance Criteria for Security ControlsAppendix B: Resources for AppSecIndex

Mark S. Merkow, CISSP, CISM, CSSLP, works at WageWorks in Tempe, Arizona, leading application security architecture and engineering efforts in the office of the CISO. Mark has over 40 years of experience in IT in a variety of roles, including application development, systems analysis and design, security engineering, and security management. Mark holds a Master of Science in Decision and Information Systems from Arizona State University (ASU), a Master of Education in Distance Education from ASU, and a Bachelor of Science in Computer Information Systems from ASU. In addition to his day job, Mark engages in a number of extracurricular activities, including consulting, course development, online course instruction, and book writing. Mark has authored or co-authored 17 books on IT and has been a contributing editor to four others. Mark remains very active in the information security community, working in a variety of volunteer roles for the Phoenix Chapter of (ISC)2®, ISACA®, and OWASP. You can find Mark’s LinkedIn® profile at: linkedin.com/in/markmerkow

Modern software development breaks the old ways of security. This book is practical, actionable, relatable, and most importantly, current. It should be required reading for all Agile and DevOps teams.—Ed Adams, Chief Executive Officer, Security Innovation, Inc.

• DedicationContentsPrefaceAbout the AuthorChapter 1: Today’s Software Development Practices Shatter Old Security PracticesChapter 2: Deconstructing Agile and ScrumChapter 3: Learning Is FUNdamental!Chapter 4: Product Backlog Development—Building Security InChapter 5: Secure Design ConsiderationsChapter 6: Security in the Design SprintChapter 7: Defensive ProgrammingChapter 8: Testing Part 1: Static Code AnalysisChapter 9: Testing Part 2: Penetration Testing/Dynamic Analysis/IAST/RASPChapter 10: Securing DevOpsChapter 11: Metrics and Models for AppSec MaturityChapter 12: Frontiers for AppSecChapter 13: AppSec Is a Marathon—Not a Sprint! Appendix A: Sample Acceptance Criteria for Security ControlsAppendix B: Resources for AppSecIndex

Mark S. Merkow, CISSP, CISM, CSSLP, works at WageWorks in Tempe, Arizona, leading application security architecture and engineering efforts in the office of the CISO. Mark has over 40 years of experience in IT in a variety of roles, including application development, systems analysis and design, security engineering, and security management. Mark holds a Master of Science in Decision and Information Systems from Arizona State University (ASU), a Master of Education in Distance Education from ASU, and a Bachelor of Science in Computer Information Systems from ASU. In addition to his day job, Mark engages in a number of extracurricular activities, including consulting, course development, online course instruction, and book writing. Mark has authored or co-authored 17 books on IT and has been a contributing editor to four others. Mark remains very active in the information security community, working in a variety of volunteer roles for the Phoenix Chapter of (ISC)2®, ISACA®, and OWASP. You can find Mark’s LinkedIn® profile at: linkedin.com/in/markmerkow

Modern software development breaks the old ways of security. This book is practical, actionable, relatable, and most importantly, current. It should be required reading for all Agile and DevOps teams.—Ed Adams, Chief Executive Officer, Security Innovation, Inc.

• DedicationContentsPrefaceAbout the AuthorChapter 1: Today’s Software Development Practices Shatter Old Security PracticesChapter 2: Deconstructing Agile and ScrumChapter 3: Learning Is FUNdamental!Chapter 4: Product Backlog Development—Building Security InChapter 5: Secure Design ConsiderationsChapter 6: Security in the Design SprintChapter 7: Defensive ProgrammingChapter 8: Testing Part 1: Static Code AnalysisChapter 9: Testing Part 2: Penetration Testing/Dynamic Analysis/IAST/RASPChapter 10: Securing DevOpsChapter 11: Metrics and Models for AppSec MaturityChapter 12: Frontiers for AppSecChapter 13: AppSec Is a Marathon—Not a Sprint! Appendix A: Sample Acceptance Criteria for Security ControlsAppendix B: Resources for AppSecIndex