Using CD Events to Capture End to End Application Security Posture
summary
Claims that CD Events + CloudEvents ingest standard pipeline signals from Jenkins, Spinnaker, Argo, Tekton, Harbor, Flux and GitHub (via adapters) into an event broker and a graph SDLC DB to produce a correlated Delivery Bill of Materials. Implementation includes a Jenkins plugin, per-tool adapters, artifact SHA/signature correlation and scans with SonarQube, Snyk/Trivy and secret scanners to allow/deny deploys. Prototype runs at OpsMx, delivers real‑time posture, enforces NIST‑style controls, and works but needs more community adapters for broad adoption.
AI-written summary · about
chapters (10)
- 0:00Application security posture intro
- 3:13Enterprise security visibility challenges
- 7:13CD events standardize pipeline events
- 10:15Mitigating breaches with CD events
- 12:43Security checks in CI
- 15:33Preventing artifact tampering
- 16:57Continuous deployment security controls
- 18:21CD and Cloud events tools
- 20:06Limitations and future improvements
- 21:19Q&A on delivery bill of materials
related talks
08mBuilding a Future of Greater Interoperability in CI/CD with CDEvents
36mBuilding DevOps Metrics for your Choice of CD Tools Through CDE...
47mGitOps and CDevents that helps me get compliant? Really??
22mCDEvents as Catalyst to Innovation in CI/CD Ecosystem
17mLet's Work Together! : CI/CD Interoperability using CDEvents
34mBuilding DevOps Metrics for your Choice of CD Tools Through CD...
42mHow To Have Visibility And Security OF A CICD Pipeline
30mCI/CD Observability: Standardizing with CDEvents