Continuous Security - Building Security into your Pipelines
summary
Concrete claims and concrete actions: over 70% of vulnerabilities are in indirect dependencies, use Snyk to scan code, images and repos, and enforce checks in CI. Scanning registries and runtime finds new risks after deploy. 40% of Docker image vulnerabilities are fixed by upgrading the base image and 20% by rebuilding. Kubernetes is insecure by default so add admission control/Open Policy Agent, precommit hooks, pull request scanning and registry scanning to catch and remediate issues early.
AI-written summary · about
chapters (24)
- 0:00Intro
- 0:40$whoami
- 0:50What is an application?
- 1:38Shifting security
- 3:50New vulnerabilities each year by ecosystem
- 4:20The direct and indirect dependency split across ecosystems
- 5:32Developers own the security of container images
- 6:02Number of OS vulnerabilities by docker image
- 6:44Linux OS vulnerabilities steadily increasing
- 8:02Configuration is increasing in code
- 8:20Configuration is everywhere
- 9:01Configuration is a security risk
- 9:45Insecure by default
- 11:15Container Security Spectrum
- 11:44Developer First...
- 12:11Remediation guidance to minimize exposure and reduce time-to-fix
- 12:54Make sure our repos are secure!
- 14:20Pull request scanning and repository monitoring
- 15:04Scan images in registries ...
- 15:34CI Pipelines
- 15:57Protect your application
- 17:00It is critical for developers to secure containers from the start
- 17:37Detect vulnerabilities
- 17:51Thank you!
related talks
31mContinuous Security – integrating security into your pipelines
39mContinuous Security at the Next Level
42mContinuous Security: Integrate security tools into your DevOps Pipeline
33mAre your Pipelines Secure? Lock-down unsecured CI/CD Pipelines- 33mAre your Pipelines Secure? Lock-down unsecured CI/CD Pipelines
43mSecurity in DevOps Strategies
45mSo Happy Together: Making the Promise of DevSecOps a Reality
46mAdding security for reliable continuous delivery