Incorporating Security into Platform Engineering: The Dos and Dont’s
summary
Argues that platform teams must integrate security across the dev lifecycle by embedding scanners at dev, repo, image, IaC, CI/CD and in-cluster stages and by favoring existing workflows and dashboards over new apps. Recommends concrete tools: Trivy (CLI and VS Code extension), Clair/Aqua for image scanning, and using connectors (e.g., a "pasty" bridge) to send findings to Slack/Jira. Emphasizes start small, make it visual, assign ownership and avoid piling extra processes on engineers.
AI-written summary · about
chapters (7)
- 0:00Start
- 4:29Who's Responsible When We Implement Security Tools
- 6:45Scan Coverage
- 7:13Focus of the Tooling
- 11:26Do's and Don'ts of Integrating Security Tools into Your Platform
- 12:54Assign Ownership
- 18:26How Can I Integrate the Tools Their Reports into Defect Dojo
related talks
26mPlatform Engineering Loves Security: Shift Down To Your Platform, Not Left To Your Developers! - Maxime Coquerel, Royal Bank of Canada
42mContinuous Security: Integrate security tools into your DevOps Pipeline
22mShifting left, how security fits into the DevOps story
27mMulti Security Checkpoints on DevOps Platform
31mPrioritizing Trust while Creating Applications
44mSecurity Practices Useful in Agile Development
01h 02mDevSecOps for Developers: How To Start
30mHandling Security Objections to DevOps