Security as Code: A DevSecOps Approach
summary
Security checks are implemented as code using CodeQL, which extracts code into a DB and runs declarative queries to find flows and misconfigurations. Example: a NASA Mars rover audit finds more than 20 array-bounds bugs via CodeQL and prevents critical failures; a Log4j/GNDI query traces data flows across 100+ call steps to a vulnerable lookup. CodeQL integrates with CI/CD (a one-click enable for open source), offers reusable community query libraries, and lets teams customize sources, sinks and sanitizers.
AI-written summary · about
chapters (8)
- 0:00Introduction to GitHub Lab
- 2:08Mars rover security bug
- 6:06DevSecOps and security shift
- 7:58Empowering developers
- 12:31Introduction to CodeQL
- 16:03Using CodeQL in CI/CD
- 18:39Writing custom CodeQL queries
- 33:01Conclusion and Q&A
related talks
33mSecurity as Code: A DevSecOps Approach
22mSecurity as Code: A DevSecOps Approach
59mSecurity as Code: A DevSecOps Approach
52mSecurity as Code: A DevSecOps Approach
24mSecurity as Code A SecDevOps Use Case
40mSecurity-as-Code to Accelerate DevSecOps, a Practical Guide to Get Started
54mFrom App Security to Dev Security – Shift left with GitHub Advanced Security
42mSecure or Insecure Code, That Is the Question