How to fit Sec into DevOps without Security team
summary
Claims four practical, automatable steps (static analysis, SCA, roles & secrets, vuln scanning) plus two bonuses for containers and artifact provenance that together close ~80% of real‑world development security problems. Recommends using built‑in DevOps features like GitHub CodeQL, Dependabot, secret scanning, open and free tools such as dependency‑check / dependency‑track, Gitleaks, and enabling runtime checks for Kubernetes. Shows the Log4Shell case where continuous security cuts inventory and patching from multi‑week chaos to two–three days of out‑of‑cycle work.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 2:01Security myths in DevOps
- 7:44DevOps security benefits
- 12:05Security without a team
- 22:10Securing containers & Kubernetes
- 26:24SLSA for trusted artifacts
- 30:45Summary
related talks
38mDevOps Meet Sec: Your Journey To Delivering Secure Code Fast
45mDevSecOps : add Security to your DevOps!
31mWhy SecDevOps is the new way in Cybersecurity?
31mDevSecOps, or How to Integrate Security into DevOps Practices
01h 02mDevSecOps for Developers: How To Start
36mUnderstanding the Sec in DevSecOps: Beyond Just Shifting Left
40mDevSecOps Guide to Bulletproof Your Development Workflow
39mDevOps: The Return of Security