Compliance-As-Code For API Security
summary
Claims a working Compliance-as-Code system that codifies ISO 27001 controls (ISO reduced from 114 to 93) and maps about 34 technical controls for user/endpoint devices into runnable checks. Implementation uses Terraform on AWS, integrates AWS Config and AWS Audit Manager, adds ECR/container and Lambda scanning, CI/CD deployment and automated nightly assessments, and produces exportable audit evidence. Deployed for banks and fintechs (including a cloud migration and Visa integration requiring mutual TLS), the modules run and flag failed controls for remediation.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:12What are compliances
- 5:06Why compliances are needed
- 7:15Baselines for compliances
- 11:57Challenges of compliances
- 17:14Why compliance as code
- 25:22Demo setup overview
- 34:42Technical controls implementation
- 46:01Automated deployment and auditing
- 50:21Q&A session
related talks
33mCompliance as Code - Lessons Learned From Regulated Organizations
58mImplementing compliance, assurance, and auditing on
05mHow To Automate Compliance If You Aren't Chuck Norris
31mStreamlining Compliance: Leveraging Open-Source Terraform AWS modules
24mSecurity Compliance as Code
45mStreamlining Compliance: Leveraging OS Terraform AWS modules
56mCloud compliance journey: Compliance and audits
45mStreamlining Compliance: Leveraging Open-Source Terraform AWS modules