Conf42 DevSecOps 2022
who it's for
platform engineers, security engineers, devops engineers, site reliability engineers, cloud engineers, application developers, engineering managers
topics
SBOM generation with syft and grype; signing SBOMs into OCI images with cosign; universal API management with Anypoint and Flex Gateway; Teleport short-lived x509 Kubernetes access; VCS argument injection exploits in package managers; Trivy operator exporting security reports to Kubernetes; central structured log ingestion with Falcon LogScale; GitHub Actions build-and-release pipelines; GitLab Auto DevOps security pipelines; DAST in CI using .har and Selenium flows; separate build vs runtime Dockerfile patterns and Docker trust sign; AWS CIS CSPM for S3 with openraven classification
| title | author | length |
|---|---|---|
| Premiere | 32m | |
This is a conference compilation; pick segments that state concrete results, show code or demos, or name tools and measurable outcomes. Look for talks that… | ||
| Making Software Bill of Materials (SBOMs) Actionable | Ciara Carey | 29m |
Claims that SBOMs become actionable by generating and attaching them to OCI images, signing and verifying them, scanning for CVEs, and quarantining artifacts… | ||
| Sustainable API Management | Akshata Sawant | 27m |
Claims that a single Universal API management plane can manage any API across clouds and runtimes get demonstrated end to end: design in Anypoint Design… | ||
| Say Goodbye to Manual Kubernetes User Access Onboarding | Kenneth DuMez | 22m |
Claims that replacing manual onboarding with open source Teleport removes copied credentials by issuing short-lived x509 certificates per session, mapping SSO… | ||
| There's somebody in my package manager! | Thomas Chauchefoin, Paul Gerste | 59m |
Concrete compromises against PHP package infrastructure: the researchers exploit a VCS argument-injection to get a remote shell via VCS argument-injection… | ||
| Crucial Log Management Skills for DevSecOps | Arfan Sharif | 29m |
Clear, practical overview of what logs to collect, how containers emit container stdout and why ephemeral lifecycles demand centralization, plus advocacy for… | ||
| True DevSecOps with People, Processes, and Technologies | Stefania Chaplin | 23m |
Argues for shifting security into merge‑request pipelines so developers fix flaws as introduced instead of finding 10,000 vulnerabilities at release. Describes… | ||
| Achieving a higher level of security so you can sleep better | Chris Webber | 26m |
CSPM checks against the AWS CIS Benchmark produce a startling result: 95–100% of S3 buckets flag as violations, so alerts are useless unless filtered. Use… | ||
| Integrating Cloud Native Security into the SRE culture | Anais Urlichs | 34m |
Claims a concrete workflow: install Trivy operator (or CLI in CI), export security reports as Kubernetes resources, and feed metrics into… | ||
| How to Contain Security in your Containers | Adrian Gonzalez | 34m |
Concrete how to: step‑by‑step Dockerfile patterns for separating build vs runtime deps, commands for Docker trust sign and key management, Azure DevOps… | ||
| Adding DAST to CI/CD, Without Any Losing Friends | Tanya Janca | 21m |
Adding a dynamic application security scanner straight into CI/CD without tuning inflates builds (one minute ballooning to nine minutes — a 900% slowdown)… | ||
| Threat Modelling in CI/CD environments | Darren Richardson | 32m |
Argues STRIDE from 1999 still maps to modern CI/CD by walking a concrete dataflow: GitHub/GitLab/Bitbucket → Jenkins pipelines → SonarQube/Aqua security scans… | ||
| Stop Committing Your Secrets - Git Hooks To The Rescue! | Dwayne McDaniel | 15m |
Repository scans find over 6 million exposed keys in 2021 and roughly three in a thousand commits contain a secret, so the proposed fix is automation: install… | ||
| Who's managing the credential for your data infrastructure? | Dewan Ahmed | 27m |
Claims that 80% of breaches trace to poor or reused passwords and demonstrates replacing static DB credentials with HashiCorp Vault issuing timebound secrets… | ||
| Flow Engineering - boost velocity, quality & happiness | Steve Pereira | 29m |
Claims a repeatable end-to-end process: pick a customer outcome, build a value stream mapping, measure stage times and delays, find a single environment setup… | ||
| How to implement a DevSecOps pipeline with zero-trust | Evan Gertis | 32m |
Claims a reproducible DevSecOps pipeline that combines Veracode SCA, JFrog X‑ray, Burp Suite, Elastic SIEM and Terraform with container scanning and automated… | ||
| Kick Your Security Up a Notch with Custom Queries | Gabriel Manor-Liechtman | 33m |
Shows how to stop noisy generic scans by writing and mounting custom Rego policies for Open Policy Agent / Rego so Kicks runs organization‑specific checks… | ||
| How HMRC Digital secures services at scale | Ben Conrad, Gerald Benischke | 28m |
Multi-channel Digital Tax Platform hosts over a thousand microservices including about 340 front ends and handles data for roughly 45 million taxpayers and 5… | ||
| Open-source vulnerability management? Use the source, Luke! | Henrik Plate | 49m |
Claims that code‑centric program analysis finds whether vulnerable code is actually contained and reachable in an application, using static call‑graph… | ||
| Taking Your DevOps Tooling To The Dark Side | Mike Guthrie | 26m |
Claims a practical zero trust retrofit that actually works not theory alone: open ZD is dogfooded at net Foundry to darken tooling including a data warehouse… | ||
| How to fit Sec into DevOps without Security team | Roman Zhukov | 32m |
Claims four practical, automatable steps (static analysis, SCA, roles & secrets, vuln scanning) plus two bonuses for containers and artifact provenance that… | ||
| The Power of AWS Tags (Advanced IAM Session) | Yoav Yanilov, Itamar Bareket | 26m |
Claims a concrete, deployable system: a tag‑based control plane that enforces ABAC and a two‑person approval flow on AWS using SCPs, IAM tags and a Lambda TTL… | ||
| Pragmatic Security Automation and DevSecOps in the Cloud | Joshua Arvin Lat | 29m |
Shows concrete risks and fixes: AWS examples (EKS + EC2 with Cloud9 in a public subnet), serverless flaws (Lambda + API Gateway vulnerable to code injection… | ||
| Building Universal CI/CD Pipelines | Lionel Lonkap Tsamba | 25m |
Claims a reusable, platform‑agnostic CI/CD shape: express intent as a ubiquitous language and generate platform manifests from it. Implements examples with… | ||
| CI/CD with Github Actions | Chris Ayers | 43m |
Shows exact YAML locations (.github/workflows), event triggers including workflow_dispatch and many webhook events, and runner details (GitHub-hosted images… | ||
| Level Up Your CI/CD With Smart AWS Feature Flags | Ran Isenberg | 27m |
Claim: dynamic feature flags reduce rollback time and enable canary and A/B flows. Implementation uses AWS AppConfig for managed, FedRAMP High configuration… | ||
| Why We Need to Adopt Static Analysis in Dependency Tools | Joseph Hejderup | 30m |
Claim: static analysis cuts irrelevant alerts by matching usage not metadata. Empirical result on the Rust ecosystem shows metadata reports a median of 17… | ||
| Anonymize application logs in DevOps way | Leonid Yankulin | 29m |
Concrete claim: logs get anonymized without changing application code by routing Cloud Logging through Pub/Sub into a Dataflow (Apache Beam) ETL that batches… | ||
| Setting up and managing GitHub actions for multiple projects | Ranjan Mohan | 20m |
Organization uses org_report repository and workflow templates in .github to manage 30 repositories with shared CI templates; workflows run on GitHub runners… | ||
| The Observant Developer - OpenTelemetry from code to prod | Roni Dover | 33m |
Claims that OpenTelemetry plus continuous feedback turns production telemetry into actionable dev signals, not just dashboards. Uses FastAPI, RabbitMQ (Pika)… | ||
| SOS: Sustainable Open Source | Floor Drees | 39m |
Nails the specifics: 97% of 2,400 audited codebases contain open source, licensing shifts like SSPL, Redis Source‑available, Elastic 2.0 and BSL cause forks… | ||
| Keep Your Enemies Close and Your Secrets Closer | Audrey Long | 22m |
A reusable Azure DevOps Marketplace extension wraps Yelp detect-secrets into pipelines, ingests CLI reports into the Azure dashboard and auto-creates backlog… | ||
| DevSecOps for AI: Introducing MLSecOps for Software 2.0 | Eugene Neelou | 42m |
Presents an actionable MLSecOps framework that maps specific controls to pipeline stages: planning with risk registers and threat modeling, dataset versioning… | ||
| Top 13 best security practices for Azure | Radu Vunvulea | 39m |
Promises thirteen practices but delivers specific claims and tools: 80% of breaches involve privileged credentials, 49% of databases lack encryption, and 25%… | ||
| Proactive cluster autoscaling in Kubernetes | Chris Nesbitt-Smith | 29m |
Shows a concrete pattern: create a placeholder pod with low priority that fills a node so the cluster autoscaler requests a replacement node as soon as real… | ||
| How to become a digital nomad without losing your job! | Arafat Dad Khan | 39m |
Claim: remote work runs from a ski resort and month-long hostel stays are feasible by negotiating direct rental deals that cut listing prices from $3,600 vs… | ||
| Is Technical Debt the right metaphor for Continuous Update? | Giulio Vian | 26m |
Argues that continuous update is not “technical debt” but a new phenomenon: OS patches arrive every 3–4 weeks, Chrome sees bi-weekly patches, Java SDK ~3… | ||
| Red Teaming AWS: Practice What You Preach | Josh Armitage | 29m |
A cloud consultancy red teams its AWS account, spins a VM and sends a phishing email to measure realism and learning. Detection metrics are concrete: 12… | ||
| Role of SRE in DevSecOps | Kalyan Dhokte | 35m |
Claims that SRE operationalizes DevSecOps by embedding security into CI/CD, reducing MTTR and P1 tickets, and automating security gates; shows a case study of… | ||
| Humans are hard, code is easy | Tom Henricksen | 28m |
Clear claim: coding skills got you the job; influence gets you the career. Gives concrete tools and failures — Java, Linux, SQL and print-statement debugging… | ||
| The Art of Defensive Programming | Joylynn Kirui | 25m |
Stats claim 68% of CEOs demand no slowdown so 50% of companies sacrifice security and 80–90% of new app code comes from open source, while shifting left… | ||
| A journey of the thousand binaries | Ixchel Ruiz | 29m |
Claims concrete statistics: 78% of code in codebases is open source and 85% contains open‑source components more than four years out of date. Practical tooling… | ||
| Let your Kubernetes environment flourish | Eli Birger, Amir Banet | 21m |
A cluster of 240 workloads costs $3,687/month today while 99% of the time the cluster uses 61 CPU cores and 261 GB yet the sum of pod requests is 156 cores and… | ||
| Integrating Security Measures Throughout Development | Francesco Vecchi | 22m |
Live demos show XSS executing an image onerror exfiltrating cookies and SQL injection logging in with or 1=1 then dumping MD5 hashes via sqlmap, path traversal… | ||
| Debugging Schrodinger's App | Steve Coochin | 38m |
A small Flask app with SQLAlchemy simulates cascading failures and actually throws a range of HTTP statuses including 418 I'm a teapot while a lamigo… | ||
| Building an engineering platform | Geert-Hinke Addink, Hylke Stapersma | 49m |
A federated engineering platform focuses on frictionless delivery of business value by shipping small capabilities with launching customers, running on an… | ||
| Securing the Software Factory | Jon Peck | 19m |
Claims concrete metrics and built features: GitHub reports 90% of the Fortune 100 on platform and uses data from 200 million projects to calculate a… | ||
| nothing matches | ||