So Happy Together: Making the Promise of DevSecOps a Reality
summary
Research shows developers carry most security responsibility, with scans from Snyk data revealing more vulnerabilities in transitive dependencies than direct ones and tiny projects ballooning (80 lines with 7 deps -> 59 transitive deps -> 713,000 lines of code). Official Docker Hub images contain dozens of CVEs (Postgres 78 MySQL 67 Node much higher). The argument: security gates break DevOps so practical fixes are integrating SCA/SAST/DAST into CI (GitHub Actions Jenkins CircleCI), pushing threat modeling into user stories, and automating container checks for Kubernetes so security enables rather than blocks delivery.
AI-written summary · about
chapters (13)
- 0:00Intro
- 5:25Who is responsible for security?
- 7:23The reality of Modern Development...
- 9:32Security of Dependencies...
- 10:18What about those ops teams?
- 11:34About those docker images...
- 13:03But that's why we have a security team right?
- 14:28Welcome to DevSecOps
- 17:11The motion of today's DevSecOps Pipeline...
- 19:10Frictionless enablement...
- 27:36Think Differently...
- 34:05Build the empathy and culture...
- 37:10Meet them where they live...
related talks
32mHow to fit Sec into DevOps without Security team
31mDevOps: You Build It, You Secure It
38mDevOps Meet Sec: Your Journey To Delivering Secure Code Fast
31mWhy SecDevOps is the new way in Cybersecurity?
46mWhat Security People Want: Making DevSecOps Happen with Containers
36mDevOps Security - Is It Really So Difficult?
13mUnderstanding DevSecOps: Risk defense across your SDLC
45mDevSecOps : add Security to your DevOps!