DevSecOps: More Than Just Pipelines
summary
Argument: DevSecOps requires more than dumping scanners into CI/CD; it treats the three DevOps ways — flow, fast accurate feedback, continuous learning — as program design. Practical moves include inventory via domain scraping and cloud repo scans, bug discovery with SAST, DAST, SCA, IAST plus IDE plugins and scheduled agent scans, developer-facing security unit tests and champion programs, threat modeling, pen testing, incident response playbooks and metrics. A maintained inventory, weekly scans and championing reduce friction in practice; community scale cited as 8,000-member community.
AI-written summary · about
chapters (26)
- 0:00intro
- 1:43preamble
- 2:15what are we going to talk about today?
- 3:21tanya janca
- 4:24what is devops?
- 4:40what is ci/cd?
- 5:58why ci/cd?
- 7:28what is application security?
- 8:01what is devsecops?
- 8:37the three ways of devops
- 9:46but what about pipelines?
- 11:03an application security program
- 11:48inventory
- 13:09finding bugs
- 15:09knowledge
- 16:03education
- 17:36give developers security tools
- 18:39secure-sdlc
- 21:23tools (outside the pipeline)
- 22:37incident response
- 23:52metrics
- 25:31summary
- 26:41resources
- 27:28join the community!!!!!!
- 28:49resources: me!
- 29:20thank you!
related talks
06mDevSecOps is a Misnomer
36mUnderstanding the Sec in DevSecOps: Beyond Just Shifting Left
31mDevSecOps, or How to Integrate Security into DevOps Practices
45mDevSecOps : add Security to your DevOps!
06mDevSecOps – Security Throughout the DevOps Pipeline
31mWhy SecDevOps is the new way in Cybersecurity?
23mTrue DevSecOps with People, Processes, and Technologies
23mDevSecOps - By Any Other Name