Keynote Session: Compliance at the Point of Change: Security and Dev..
summary
Claim: shifting compliance enforcement to the deployment boundary reduces developer friction while preserving auditability. The pattern separates doing vs verifying compliance so teams own their CI/CD pipelines and security teams provide verifiable controls like Kubernetes admission controllers (implementable with OPA) and published CircleCI orbs. Examples: Snyk scan artifacts, signed SBOMs in OCI registries, and admission-time API checks against Jira. Outcome: continuous, repeatable enforcement at change time and measurable year‑over‑year ROI.
AI-written summary · about
chapters (9)
- 0:00Start
- 5:44Maintaining Developer Ownership of the Pipeline
- 7:38The Everyday Context
- 8:27Compliance: Typical Response
- 9:51Compliance at the Point of Change
- 11:12Rigorous verification of compliance
- 13:46Point-of-Change Compliance: Code Analysis
- 17:02Point-of-Change Compliance: Bill of Materials
- 18:09Point-of-Change Compliance: Approvals
related talks
33mCompliance Without the Chaos: Building It Right Into Your DevOps...
10mKeynote: CloudNativeDevSecOps
22mBridging Compliance and Innovation: A Guide for DevOps Leaders
31mWrangling Compliance in the Wild West of Software Delivery
11mKeynote: Like a Magic Eye Illusion: Seeing the Bigger Picture for Cloud-Native S...
05mHow To Automate Compliance If You Aren't Chuck Norris
15mKeynote: The Security Symphony
30mHandling Security Objections to DevOps