True DevSecOps with People, Processes, and Technologies
summary
Argues for shifting security into merge‑request pipelines so developers fix flaws as introduced instead of finding 10,000 vulnerabilities at release. Describes using CI/CD review apps and integrated scanners—SAST, DAST, SCA, secret detection—with a single platform like GitLab Auto DevOps to produce dashboards, audit logs, and predictable costs. Shows a working pipeline pattern: feature branch scans, developer remediation, merge, small runtime checks, and measurable reduction in late production fixes and remediation cost.
AI-written summary · about
chapters (15)
- 0:00DevSecOps introduction
- 1:13Three pillars explained
- 3:22Business impact of DevSecOps
- 5:28Shifting security left
- 7:54Cost of late remediation
- 8:59Old vs modern security workflows
- 10:45Security in CI/CD
- 12:11Security team benefits
- 13:12Example pipeline with scans
- 15:00Simplifying tooling
- 16:06Compliance automation
- 17:28Desired outcomes
- 19:14Empowering developers
- 20:58App security testing
- 22:02Driving business value
related talks
30mDevSecOps: More Than Just Pipelines
31mDevOps: You Build It, You Secure It
45mLessons From DevOps: Taking DevOps Practices Into Your AppSec Life
39mDevOps: The Return of Security
31mWhy SecDevOps is the new way in Cybersecurity?
48mDevOps Is Automation, DevSecOps Is People
30mHandling Security Objections to DevOps
31mDevSecOps, or How to Integrate Security into DevOps Practices