Continuous Assurance and Continuous Compliance via Data, Graph, Query and Code
Talkat Cloud Native Security Day 2019 · on Monday, 2019-11-18· at 11:25· Marriott Marquis San Diego Marina - San Diego Ballroom A, 333 W Harbor Dr·
summary
LifeOmic describes a working system that turns frameworks into JSON, policies into markdown, and cloud signals from AWS GCP Okta GitHub into one graph, queried by a custom language to produce evidence, alerts, charts and JIRA/Slack tickets. The team runs minimum of 20 deploys/week, maps HIPAA and SOC2 controls to queries, finds unencrypted S3/EBS/RDS/DynamoDB instances, and correlates vulnerability commits to authors. The product JupiterOne automates gap analysis and continuous monitoring as compliance as code.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 1:17Compliance is a necessary evil
- 3:27Questions to ask yourself
- 4:32Datadriven compliance
- 6:14JSON representation
- 8:07Policies and Procedures
- 10:25Data
- 13:12Query Language
- 16:47Complete Compliance Picture
- 19:12Map to Compliance Framework
- 20:51Dashboard
- 21:44End Result
- 22:14Use Cases
- 22:43A3 Environment
- 23:13Single SignOn Access
- 23:56Alerts
- 24:16Metrics Charts
- 24:28Internal Knowledge Base
- 25:07Questions
related talks
05mFully automated production deployments with HIPAA HITRUST compliance
37mDevOps - The Automation of Compliance
33mCompliance as Code - Lessons Learned From Regulated Organizations
29mAutomating Continuous Compliance for Scalable SaaS Delivery
33mCompliance Without the Chaos: Building It Right Into Your DevOps...
37mPath To Production: Sustainable Compliance In Strict Environments
30mAutomating Governance - Dear Security, Compliance, & Auditors We’re Sorry. Love DevOps
54mCompliance-As-Code For API Security