Dev-first security: From code to cloud, and back to code (PRT291)
summary
Explains a concrete dev-first move: create a Cloud Center of Excellence, migrate apps (about 90% moved to AWS), replace SonarQube plus ad hoc checks with Snyk starting from the CLI, hooking into Git repos, IDE plugins and CI pipelines, and buying enterprise after pilot; add auto‑remediation for S3 encryption and a golden infra baseline; scale via a security‑champion program and risk‑based prioritization rather than checklisted compliance. Key numbers and flow are explicit and repeatable. Snyk CLI → IDE plugin → pipeline 32M developers, 4M security pros
AI-written summary · about
chapters (11)
- 0:00Start
- 1:13Every company is a technology company
- 1:38Scale: Developers & Security
- 3:19Speed: Rapid Iteration
- 5:46Shifting Left is Not Enough
- 11:51Scaling Security with Developers
- 17:29Meet the Developers Where They Are
- 19:21Cloud native apps require a unified view of apps and cloud together
- 22:42Security Champions
- 25:37Security Ownership
- 55:21Dev First Security Integrations with AWS
related talks
54mFrom App Security to Dev Security – Shift left with GitHub Advanced Security
04mContinuous Integration, Continuous Delivery. Continuous Security?
41mWhat Is Devsecops? Key Steps to Do It Well
31mDevSecOps, or How to Integrate Security into DevOps Practices
45mDevSecOps : add Security to your DevOps!
01h 04mTransformation Blueprint for Developer-Centric Application Security
28mDevSecOps - Security from Scratch
01h 04mShifting Security Everywhere