How to implement Security as Code?
summary
Claims that automation shortens the window between vulnerability disclosure and remediation, backed by numbers: about 25,000 CVEs last year, ~25% with known exploits and many exploitable within 30 days while average rollout of fixes takes ~246 days. Shows concrete tools and outcomes: built inspec (sold to Chef, adopted by Fortune 500 and Department of Defense) and a graph-based asset inventory, publishes an open Mondo registry of reusable policy as code. Demonstrates local-to-prod enforcement, runtime plus pipeline coverage, and that the approach works in production.
AI-written summary · about
chapters (12)
- 0:00Security as Code intro
- 3:06Why Security as Code matters
- 7:49Ransomware and CVE crisis
- 10:20Security vs engineering gap
- 13:53Tooling mismatch problem
- 14:35Holistic security approach
- 16:23Securing dev phases
- 18:32Unified security policies
- 20:17Policy as Code
- 21:02Implementation requirements
- 22:45Demo: Cloud bucket security
- 26:22Q&A
related talks
33mSecurity as Code: A DevSecOps Approach
37mPlatform and Security Engineering
24mSecurity as Code A SecDevOps Use Case
46mRugged Software Engineering
14mHow Security as Code Transforms Platform Engineering at Scale
52mSecurity as Code: A DevSecOps Approach
59mSecurity as Code: A DevSecOps Approach
37mHow to get developers to want to adopt AppSec