Building Security Frameworks Into Your CI/CD Pipelines
summary
Allstate shows how security is codified into CI/CD: user stories map to NIST controls via BDD/Gherkin and tests run in Jenkins so static and dynamic scanners (Black Duck, w3af, Rapid7 Nexpose), CIS-benchmark checks via Chef/Test Kitchen, and stemcell scans gate blue/green deploys through DeployDactyl/Conveyor and Artifactory. Results stream into RSA Archer as artifacts, exceptions live as JSON in source, and teams phase in rules (start as notifications, then break the build). The pipeline enables continuous audit and automated, multi-foundation enforcement.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 0:15The security team's role
- 2:19Agile security process flow
- 3:09Defining security requirements
- 4:58Laws as user stories
- 6:33Shifting security left
- 7:29Gherkin syntax for security
- 9:03Documentation as governance
- 9:44API documentation standards
- 10:14Iteration planning
- 10:33BDD for security
- 14:48Platform security
- 15:00Stem cell configuration
- 16:07Automated security tools
- 18:18Continuous auditing
- 18:29Automated scanning tools
- 23:34Real-time risk feedback
- 26:39Dynamic GRC views
- 27:19Automating security plans
- 28:22Q&A session
- 28:51Managing scan velocity
- 29:33Future security outlook
related talks
29mSecuring Your Web Application Pipeline From Intruders
42mContinuous Security: Integrate security tools into your DevOps Pipeline
32mAutomating Security Compliance at Scale
39mContinuous Security at the Next Level
43mSecurity in DevOps Strategies
25mDecoupling DevSecOps from CI/CD Pipelines
38mSecuring your CI/CD Pipeline
40mBest Practices for Securing CI/CD Pipelines or How to Get Security Right