DevSecOps: Five Common Mistakes
summary
Five recurring mistakes: skipping security-by-design and missing security acceptance criteria; undertraining devs so they patch symptom strings instead of root causes; ignoring thousands of third‑party flaws; and treating scanner output with incoherent priorities. The remedy shown is concrete: add security acceptance tests, appoint a security champion, run dependency checks like OWASP dependency-check and npm audit and automated scanners such as ZAP and nmap in CI; automation cuts noisy manual pentests and lets security focus on true high‑risk findings.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:49Why DevSecOps matters
- 4:42Security is everyone's job
- 5:08Mistake 1: No security design
- 9:29Mistake 2: Lack of education
- 11:24Mistake 3: Ignoring vulnerabilities
- 16:18Mistake 4: Misaligned priorities
- 18:57Mistake 5: Security in CI/CD
- 25:29Conclusion and management role
- 26:56Q&A
related talks
45mDevSecOps Worst Practices
34mDevSecOps: How to Use DevOps to Make You More Secure
47mSecurity is Everybody's Job
43mTen DevSecOps Culture Failures
31mDevOps: You Build It, You Secure It
32mHow to fit Sec into DevOps without Security team
05m5 Pitfalls of Using DevOps to Govern
45mDevSecOps : add Security to your DevOps!