Building a Secure DevOps Pipeline
summary
Shows how a security pipeline that normalizes scanner output into a central vulnerability DB and uses REST APIs, Docker, ZAP and Jenkins to weaponize Jenkins and run health checks lets two FTEs assess 35 apps in a year and a company jump from ~44 to ~200 to 414 assessments (about a 9.4× improvement) after ~3 months of setup. Emphasizes pushing validated findings into DefectDojo, JIRA or Slack and converting recurring bugs into automated turn findings into tests that run in CI.
AI-written summary · about
chapters (25)
- 0:00Introduction
- 0:38AppSec Pipeline
- 2:17Trains
- 2:56Travel
- 4:04Trains Change
- 4:52DevOps Changes
- 5:32Meeting in the Middle
- 6:00Pipelines
- 6:57Key Features
- 8:34Pipeline
- 14:32DevOps Handbook
- 15:02AppSec Team
- 25:38Wasp
- 26:49Defect Dojo
- 27:08Rap
- 27:31Automation
- 28:04Chat Ops
- 30:59Never get success
- 32:02Ask the bots
- 34:01Push to S3
- 35:05ChatOps
- 36:04Security Tests
- 36:23Security Test
- 38:49Case Studies
- 39:36Pipeline Company 2
related talks
01h 18mDevSecOps - Automating Security in DevOps
51mTaking AppSec to 11: Pipelines, DevOps and making things better
46mSecurity DevOps - Staying Secure In Agile Projects
59mDevOps for the Discouraged
42mContinuous Security: Integrate security tools into your DevOps Pipeline
27mStandard Classification: Automate Security, Don't Tell Your Boss
42mMaking Continuous Security a Reality with OWASP’s AppSec Pipeline
31mDevOps: You Build It, You Secure It