How to implement a DevSecOps pipeline with zero-trust
summary
Claims a reproducible DevSecOps pipeline that combines Veracode SCA, JFrog X‑ray, Burp Suite, Elastic SIEM and Terraform with container scanning and automated ticketing and security champions; shows a repo with 254 Jackson Databind vulnerabilities reduced to near zero over six months and a Varicode score 58→94; provides concrete CI/CD steps (Jenkins x‑ray plugin, build info, PDF reports), prebuilt dashboards and a self‑service ticket workflow, and reports that penetration tests are supported by systematic logging.
AI-written summary · about
chapters (15)
- 0:00DevSecOps with zero-trust intro
- 2:00Five DevSecOps takeaways
- 3:46Accountability with tools
- 5:29Security fire walkers
- 7:34Leadership for change
- 9:00DevSecOps tools
- 11:50Container scanning & vulnerabilities
- 14:37Cloud security compliance
- 17:25Shift left with JFrog X-Ray
- 19:10Security reporting matters
- 21:17Automated security reviews
- 23:45Automate tasks reduce meetings
- 25:09Pipeline results victory lap
- 29:23Zero-trust secure pipelines
- 30:50Q&A
related talks
43mBuilding a Secure DevOps Pipeline
28mDevSecOps - Security from Scratch
01h 18mDevSecOps - Automating Security in DevOps
39mContinuous Security at the Next Level
42mContinuous Security: Integrate security tools into your DevOps Pipeline
30mSecuring DevOps using OWASP DevSecOps Tools
38mDevOps Meet Sec: Your Journey To Delivering Secure Code Fast
44mThe Implementation and Practice of DevSecOps