Baking Safety into Infrastructure Testing
summary
Argues that testers must make safety measurable and automated by turning audit controls into executable checks, using Chef’s open source language InSpec to codify rules as compliance as code that run against Linux, Windows and containers. Shows real harms (medical devices, MotoGP failure, VW scandal) to justify continuous checks, describes profiles and executable controls, and claims continuous compliance replaces monthly audits. Demonstrates automation working as a team member to preserve common ground and reduce handoff failures.
AI-written summary · about
chapters (17)
- 0:00Start
- 5:15A Software Error Caused the Failure of Valentino Rossi's Bike at Mugello
- 6:59Pre-DevOps
- 10:26What about Security?
- 11:28Patching
- 16:52Safety can be predicted by organizational culture
- 23:11Common ground is Not a "thing" Not a state Instead, it is a process
- 25:09Signaling carries a responsibility to judge the interrupt-ability of the other person
- 28:52Coordination: managing dependencies between activities
- 30:44Interpredictability
- 31:17Most important types: Pertinent Mutual Knowledge, Beliefs, and Assumptions
- 32:37Why do teams lose common ground?
- 37:54Common ground is not binary!
- 40:10Safety is conveyed through actions
- 43:16Mapping Compliance to InSpec
- 44:57InSpec Profiles
- 46:05TIME TO CHANGE
related talks
31mShifting Left Securely
39mTrust teams but verify: compliance as code done right
28mFrom Monitoring to Automated Testing of Your Infrastructure Code
41mA Year with Chef and InSpec: A Retrospective with Optum
38mKick Starting our DevOps Transition with Chef Compliance
33mTest Driven DevOps
17mEnhancing cloud security with continuous compliance
05mHow To Automate Compliance If You Aren't Chuck Norris