DevSecOps State of the Union
summary
Summarizes ~40 recent DevSecOps talks and distills concrete wins: automated least‑privilege via repo‑kid that prunes AWS permissions until failure, an assume‑role detection pattern plus metadata‑proxy PoCs to catch leaked creds, and Airbnb’s transparent mutual TLS service mesh that secures thousands of services without code changes. Case study analyzes historical bugs and finds secure wrapper libraries and custom linters often reduce risk more cheaply than heavyweight SAST for that codebase, while Semmle/QL and Ocular enable targeted dataflow hunting where needed.
AI-written summary · about
chapters (11)
- 0:00Introduction and themes
- 4:18Visibility and alerts
- 6:33Pipeline and risk
- 8:26Eliminating bug classes
- 10:54Identity and security
- 14:29Configuration management
- 16:15Proxy and C-Surf
- 18:31Human augmented analysis
- 19:01Client case study
- 25:47Shifting to secure defaults
- 28:37Resources and conclusion
related talks
51mSecDevOps: Current Research and Best Practices
40mThe State of the Union of DevSecOps
34mDevSecOps: How to Use DevOps to Make You More Secure
31mDevSecOps, or How to Integrate Security into DevOps Practices
45mDevSecOps : add Security to your DevOps!
39mSecurity in a DevOps World
32mHow to fit Sec into DevOps without Security team
31mDevOps: You Build It, You Secure It