Securing Your Pipes with a TACO
summary
Framework maps actual pipeline controls to org controls and ships a concrete checklist of 25 automatable controls that get codified into opinionated pipelines. Teams implement API-driven credential provisioning, secret storage with HashiCorp Vault, automated SAST gating with delta thresholds, artifact versioning and build once deploy many, service-spec validation of target environments, and centralized log-based auditing after Hygieia proved brittle. Result: automated compliance and traceability across Jira, CI, Ansible and Selenium (BDD SIFT) that shrinks deployment cycles (example: six months to one month) and produces measurable audit evidence.
AI-written summary · about
chapters (16)
- 0:00Start
- 1:59Agenda
- 4:57Introducing change
- 6:46Pipeline overview
- 8:35Bunch of pictures
- 9:26Hitting a wall
- 9:57Lost in translation
- 26:37What we did
- 30:41Modeling
- 34:12Example
- 35:23Visualize how much TACO
- 36:42Mapping the controls
- 37:59Running the pipe Build Results
- 40:32Auditing the pipe
- 41:53Paved road
- 43:26So let's review
related talks
26mProtect the Pipe! A Policy-based Approach for Securing CI/CD Pipe...
10mIt's Time We Start Securing Our CICD Pipelines
33mSecuring Your Infrastructure as Code Pipeline
29mSecuring Your Web Application Pipeline From Intruders
19mWho Are You Building For: Pipelines Have a Purpose
20mLife hacks for automating DevSecOps security tasks
20mCI/CD Agility and Controlling Pipeline Sprawl
35mSecuring the Perimeter - CFCR/CFAR Chain of Custody With CI/CD Pipelines