Continuous Security: Integrate security tools into your DevOps Pipeline
summary
Shifts security left by integrating concrete tools into CI/CD: run OWASP Dependency-Check or npm audit to scan libraries and fail builds on critical CVEs, add SonarQube rules for inline static checks, use ZAP quick scan in the pipeline and schedule full active scans against staging (active scans are resource heavy and can disrupt services), validate TLS with SSL tools and Mozilla Observatory, use ASVS and Cheat Sheets for checklists, and note high performers spend about 50% less time remediating security issues.
AI-written summary · about
chapters (39)
- 0:00Introduction to Continuous Security
- 1:04Why build secure software
- 2:09Shifting security left in DevOps
- 3:10Measuring DevOps performance with security
- 4:34Integrating security into CI/CD pipelines
- 5:36Tools and languages covered
- 5:57Introduction to OWASP
- 7:00OWASP Dependency-Check for vulnerabilities
- 9:48Dependency-Check in Java projects
- 10:50Dependency-Check for .NET and PHP
- 11:52Jenkins integration for Dependency-Check
- 12:13Real-world Dependency-Check results
- 13:39Fixing vulnerabilities with Dependency-Check
- 14:20npm audit for JavaScript security
- 15:04SonarQube for static code analysis
- 16:30SonarQube security rule sets
- 17:12SonarQube Jenkins integration
- 18:17SonarQube setup and demo
- 18:58OWASP ZAP for web vulnerability scanning
- 20:23ZAP integration methods
- 21:04ZAP GUI and Jenkins plugin
- 22:30Running ZAP in CI/CD pipelines
- 23:11ZAP scan types and safety
- 24:35ZAP API and OpenAPI integration
- 25:39Preventing API misconfigurations
- 26:20Optimizing ZAP in pipelines
- 27:21OSAFT for TLS certificate validation
- 28:04Using OSAFT in infrastructure code
- 29:07OWASP ASVS for application security
- 29:49ASVS for DevOps infrastructure
- 30:32OWASP Cheat Sheet Series
- 31:37Benefits of security cheat sheets
- 32:17Secure password storage guidance
- 33:00Mozilla Observatory for HTTP headers
- 34:29Implementing Mozilla Observatory
- 35:11Failing builds on security headers
- 35:56Quick review of all tools
- 37:18Securing CI/CD pipeline infrastructure
- 38:20Final takeaways and resources
related talks
39mSecurity Tooling in Your DevOps Pipeline
29mSecuring Your Web Application Pipeline From Intruders
31mContinuous Security – integrating security into your pipelines
43mSecurity in DevOps Strategies
39mContinuous Security at the Next Level
45mDevSecOps : add Security to your DevOps!
07mInterview
44mSecurity Practices Useful in Agile Development