5 Open Source Cloud Native Security Tools
summary
Five critical controls get wired into CI/CD and actual tools are named and tested: Dependency-Check (adm-zip with 3 CVEs), Gitleaks for secrets (detects a secret at Dockerfile line 8), KICS for Terraform (flags DynamoDB unencrypted as medium), OWASP ZAP for runtime scans, and Trivy for container images. A GitHub Actions workflow runs five jobs in parallel, uploads reports, and demonstrates the scanners finding real issues so the pipeline actually detects and reports vulnerabilities.
AI-written summary · about
chapters (10)
- 0:00Open source security tools
- 1:28Building a security platform
- 2:54Evaluating security tools
- 4:19Dependency check
- 6:28Secret detection
- 8:19Terraform scanning
- 10:24Runtime scanning
- 12:08Container scanning
- 13:15CI pipeline demo
- 19:07Full security program
related talks
39m5 Open Source Security Tools All Developers Should Know About
42mContinuous Security: Integrate security tools into your DevOps Pipeline
32mClimbing high — getting started with cloud native security through open source
39mContinuous Security at the Next Level
46m5 Open Source Security Tools All Developers Should Know About
39mSecurity Tooling in Your DevOps Pipeline
18mContinuous Security - Building Security into your Pipelines
01h 21mFirst Steps to Full Lifecycle Security with Open Source Tools