The SecDevOpronomicon
summary
Security teams are often outnumbered 100 to 1, so the talk argues for two concrete levers: ship secure-by-default libraries (examples: ban raw md5 by exposing a non-cryptographic md5 wrapper; a test that enumerates routes and fails if no auth check runs) and add fast automated checks in the SDLC (pre-commit/pre-push greps to reject secrets or eval use, CI checks to block new inline JS, dependency scoring). Uses Chef/Puppet for infra and integrates with GitHub/Jenkins; warns commercial SAST often runs hours or days and needs months of rollout.
AI-written summary · about
chapters (13)
- 0:00Introduction and setup
- 1:08Speaker background and talk overview
- 3:40Agile DevOps security challenges
- 8:19Core security automation focus
- 9:04Secure by default libraries
- 12:17Static vs dynamic analysis basics
- 14:45Developer machine checks
- 15:49Code hosting security checks
- 21:31Commercial SAS tools ROI
- 24:21Dynamic analysis and fuzzing
- 25:45Building custom security tools
- 26:27Production monitoring techniques
- 28:54Q&A and closing
related talks
32mHow to fit Sec into DevOps without Security team
24mSecurity as Code A SecDevOps Use Case
51mSecDevOps: Current Research and Best Practices
31mWhy SecDevOps is the new way in Cybersecurity?
31mDevSecOps, or How to Integrate Security into DevOps Practices
34mDevSecOps: How to Use DevOps to Make You More Secure
45mDevSecOps : add Security to your DevOps!
45mSo Happy Together: Making the Promise of DevSecOps a Reality