Security as Code: A DevSecOps Approach
summary
Shows how to codify security checks using CodeQL integrated into CI/CD, demonstrating the VS Code extension, built‑in dataflow templates, and a live query that finds an OWASP mobile app SQL injection by tracing user input through >10 steps into a rawQuery sink. Explains how NASA wrote a generic CodeQL query and found 30 variants, and notes CodeQL is free for open source and lets teams convert recurring bug patterns into executable, reviewable security rules.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 3:20Lessons Learned
- 5:09SQL Injection
- 7:31Codeql
- 9:08Demo
- 10:05Explanation
- 14:05Syncs
- 15:35Data Flow
related talks
33mSecurity as Code: A DevSecOps Approach
59mSecurity as Code: A DevSecOps Approach
37mSecurity as Code: A DevSecOps Approach
52mSecurity as Code: A DevSecOps Approach
40mSecurity-as-Code to Accelerate DevSecOps, a Practical Guide to Get Started
54mFrom App Security to Dev Security – Shift left with GitHub Advanced Security
24mSecurity as Code A SecDevOps Use Case
36mAge of DevSecOps, How to Take It Into Use and What Does It Mean for QA Specialists