DevSecOps – Security Throughout the DevOps Pipeline
summary
Claims that a final security gate can be eliminated by shifting left into design and development with concrete practices and tooling rather than vague exhortations. Security provides standards, threat lists, abuse cases and six kinds of security stories that map to risks. Teams use peer reviews before commit plus code scanning at commit stage and automated acceptance tests that include penetration testing fuzzing and misuse tests so the pipeline ships only what was actually tested.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:45SHIFT LEFT ON SECURITY
- 1:00SECURITY PROFESSIONALS PROVIDE
- 1:15PROJECT SECURITY GUIDANCE
- 1:45SECURITY STORIES
- 2:16SECURITY USER STORIES
- 2:31TRUST BOUNDARIES
- 2:46MANAGE THE BACKLOG
- 3:16ARCHITECTURE & DESIGN
- 3:31SECURE CODE
- 3:46SECURITY TESTING
- 4:32SECURITY IN YOUR DEPLOYMENT PIPELINE
related talks
06mDevSecOps is a Misnomer
39mDevOps: The Return of Security
30mDevSecOps: How Secure Is Your Pipeline?
01h 02mDevSecOps for Developers: How To Start
30mDevSecOps: More Than Just Pipelines
50mSeamless Integration of Security Practices into the DevOps Pipeline
04mThe relationship between DevOps and security
31mWhy SecDevOps is the new way in Cybersecurity?